test: fix V4 dirty mock, reject in-checkout output, typed blob errors

- test_dfg_re20: the dirty-checkout test now supplies all three git
  responses (HEAD:src, HEAD, status) and asserts the call order, so it
  reaches the clean-checkout rejection instead of StopIteration.
- run_dfg_re20: --output inside the source checkout is refused before
  provenance, plan writing or any CUDA work (receipts would dirty the
  recorded source); tested with the checkout root and nested paths.
- source_provenance.historical_files: validates all paths first and
  reports an unreadable blob as HistoryUnavailable, not a raw
  CalledProcessError; tested with a failing git show.

No physics thresholds changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/validation/dfg_re20.md

@@ -0,0 +1,54 @@
+# DFG 2D-1 (Re 20) against the official reference intervals
+
+`tests/validation/run_dfg_re20.py` runs the steady DFG 2D-1 case on the refined
+channel root (D40 root, D80 wide fine patch) and on the uniform D80 grid. Geometry,
+inflow, initial state, layout and observation are those of the pinned Re100 runner
+(`run_refined_dfg.py`, `re100_helpers.py`, both unchanged); only the lattice
+viscosity is set for Re 20 (root tau 0.56, fine 0.62, uniform 0.62, lattice speed 0.01).
+
+Label: "compared against the official reference bands", not a full benchmark
+certification: the outlet is pressure-NEQ (`neq_extrap`), not do-nothing, and the
+inlet is local Zou-He.
+
+## Quantities
+
+- Cd = 2 Fx / (rho U^2 D), Cl = 2 Fy / (rho U^2 D), interval means over each sample.
+- p_diff = p(0.15, 0.2) - p(0.25, 0.2), linear extrapolation to the exact surface
+  points (`re100_helpers.pressure_probes`). The helper returns dp / (rho U^2) in
+  scaled units; p_diff = dp * 0.04 for U = 0.2 m/s, rho = 1. Both are reported.
+- Official intervals (Schaefer & Turek 1996): Cd [5.57, 5.59], Cl [0.0104, 0.0110],
+  p_diff [0.1172, 0.1176].
+
+## Bounds and steady rule (frozen before any run)
+
+- End time t* = 60 (30 s physical): 240,000 refined root steps, 480,000 uniform steps.
+- One sample every t* = 0.5 (0.25 s) at the end of a synchronized root step; Cd and
+  Cl are interval means. Trailing window t* 50..60 inclusive (21 samples).
+- Steady rule (our engineering choice, not official): in the window, for each of Cd,
+  Cl, p_diff, max - min <= 10 % and |least-squares slope x window| <= 2 % of its
+  official interval width (range 2e-3 / 6e-5 / 4e-5; slope 4e-4 / 1.2e-5 / 8e-6).
+  Absolute limits, so the small Cl is never a divisor. Never relaxed after a run.
+- The verdict uses the window mean; the distance to the nearest interval edge is
+  reported for each quantity (negative outside).
+- Force sign: fluid on cylinder, x along the inflow, y up from the bottom wall; Cd > 0
+  and the official Cl > 0 (`cd_positive` is reported).
+- Not steady at t* = 60: status `NOT_STEADY`, no interval verdict. Health limits
+  (Mach <= 0.2, rho in [0.5, 1.5]) stop the run with `UNHEALTHY`.
+- Steady: `WITHIN_INTERVALS` or `OUTSIDE_INTERVALS`, with the per-quantity verdict.
+
+## Run
+
+```
+python tests/validation/run_dfg_re20.py --output <new-dir> --plan
+CUDA_VISIBLE_DEVICES=<n> python tests/validation/run_dfg_re20.py --case both \
+    --collision SRT --output <new-dir> --max-wall-seconds <cap>
+```
+
+The uniform D80 control separates method error from refinement error. `--plan` writes `plan.json` only. A GPU run writes `plan.json` and `result.json`
+(per case: lattice parameters, every sample, window ranges, status, verdict).
+Receipts: `plan.json` and `result.json` carry `schema` 2 and `provenance` (HEAD, src tree,
+runner hash; clean checkout required, refused if it changes during the run). Receipts
+written before this (schema 1, e.g. evidence 70f6617) are a bare list of cases. Read both
+with `run_dfg_re20.read_result(path)` (`["cases"][0]` replaces the old `[0]`); existing
+evidence scripts stay valid for schema-1 receipts and need this reader for new ones.
+Host contract tests: `tests/unit/test_dfg_re20.py`.

tests/integration/test_checkpoint_bodies_gpu.py

@@ -0,0 +1,66 @@
+"""Checkpoint save -> load round trip for a scene with passive bodies. Requires GPU.
+
+A fresh Simulation with the same scene, restored from the checkpoint must hold the same populations,
+flags, body count and step count, and must stay bitwise identical to the original
+after both continue for the same number of steps. Checkpoints with Jets are
+refused (documented limitation) and are not covered here.
+"""
+
+import os
+import tempfile
+import unittest
+
+import numpy as np
+
+from ._cases import make_sim
+
+# Three separated cylinders (pinball-like); cut-link receivers stay in bulk fluid.
+CIRCLES = (((40, 32), 6), ((56, 22), 6), ((56, 42), 6))
+
+
+def scene():
+    sim = make_sim()
+    sim.initialize()
+    for center, radius in CIRCLES:
+        sim.add_body("circle", center=center, radius=radius)
+    sim.sync_bodies()
+    return sim
+
+
+class CheckpointBodiesGPU(unittest.TestCase):
+    def test_round_trip_is_bitwise_and_continues_identically(self):
+        sim = scene()
+        sim.run(60)
+        with tempfile.NamedTemporaryFile(suffix=".h5", delete=False) as f:
+            path = f.name
+        restored = None
+        try:
+            saved = sim.save_checkpoint(path)
+            # The loader requires the same body count and geometry: rebuild the scene.
+            restored = scene()
+            restored.load_checkpoint(saved)
+
+            self.assertEqual(restored.bodies.count, len(CIRCLES))
+            self.assertEqual(restored.stepper.step_count, sim.stepper.step_count)
+            np.testing.assert_array_equal(restored.get_flags(), sim.get_flags())
+            a, b = sim.get_ddf(), restored.get_ddf()
+            self.assertEqual(a.dtype, b.dtype)
+            self.assertEqual(a.tobytes(), b.tobytes())
+
+            sim.run(40)
+            restored.run(40)
+            self.assertEqual(restored.stepper.step_count, sim.stepper.step_count)
+            a, b = sim.get_ddf(), restored.get_ddf()
+            self.assertTrue(np.isfinite(a).all())
+            self.assertEqual(a.tobytes(), b.tobytes())
+            for i in range(len(CIRCLES)):
+                self.assertTrue(np.all(np.isfinite(restored.read_force(i))))
+        finally:
+            if restored is not None:
+                restored.close()
+            os.unlink(path)
+            sim.close()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_dfg_re20.py

@@ -0,0 +1,133 @@
+"""CPU-only contract tests for run_dfg_re20. Not CUDA or DFG acceptance evidence."""
+
+import sys
+from pathlib import Path
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "validation"))
+import run_dfg_re20 as v  # noqa: E402
+import run_refined_dfg as rr  # noqa: E402
+
+h, _ = rr.helpers(rr.DEFAULT_SOURCE)
+
+
+def rows(values, tstar_end=v.TSTAR_MAX):
+    n = int(round(tstar_end / v.SAMPLE_TSTAR))
+    return [dict(tstar=(i + 1) * v.SAMPLE_TSTAR, **values(i)) for i in range(n)]
+
+
+class Re20Contract(unittest.TestCase):
+    def test_lattice_parameters_and_bounds(self):
+        root, uniform = v.lattice_parameters(40), v.lattice_parameters(80)
+        self.assertAlmostEqual(root["tau"], 0.56, places=12)
+        self.assertAlmostEqual(uniform["tau"], 0.62, places=12)
+        self.assertEqual((root["steps"], root["interval"]), (240000, 2000))
+        self.assertEqual((uniform["steps"], uniform["interval"]), (480000, 4000))
+        self.assertAlmostEqual(v.plan()["refined_fine_tau"], 0.62, places=12)
+
+    def test_config_only_changes_viscosity(self):
+        base = v._re100_config(h, 40, "SRT", "none")
+        cfg, body, p = v.config(h, 40, "SRT")
+        self.assertAlmostEqual(cfg["physics"]["viscosity"], 0.01 * 40 / 20, places=15)
+        self.assertEqual((p["re"], p["viscosity"]), (20.0, cfg["physics"]["viscosity"]))
+        base[0]["physics"]["viscosity"] = cfg["physics"]["viscosity"]
+        self.assertEqual(base[0], cfg)
+        self.assertEqual(base[1], body)
+        with self.assertRaisesRegex(ValueError, "no Jets"):
+            v.config(h, 40, "MRT", "zero")
+
+    def test_units(self):
+        s = v.sample([2.0, -0.5], 4, 40, 3.0)
+        den = rr.SPEED**2 * 40 / 2
+        self.assertAlmostEqual(s["cd"], 2.0 / 4 / den)
+        self.assertAlmostEqual(s["cl"], -0.5 / 4 / den)
+        self.assertAlmostEqual(s["p_diff"], 3.0 * 0.04)
+        self.assertEqual(s["dp_scaled"], 3.0)
+
+    def test_steady_and_verdict(self):
+        inside = dict(cd=5.58, cl=0.0106, p_diff=0.1174)
+        out = v.summarize(rows(lambda i: inside))
+        self.assertEqual((out["status"], out["steady"], out["window_samples"]),
+                         ("WITHIN_INTERVALS", True, 21))
+        self.assertTrue(out["cd_positive"])
+        self.assertAlmostEqual(out["edge_distance"]["cl"], 0.0002)
+        self.assertTrue(all(out["verdict"].values()))
+        low = v.summarize(rows(lambda i: dict(inside, cl=0.0100)))
+        self.assertEqual(low["status"], "OUTSIDE_INTERVALS")
+        self.assertFalse(low["verdict"]["cl"])
+
+    def test_slow_drift_gives_no_verdict(self):
+        # Range 2e-5 passes (limit 6e-5); slope * window 2e-5 exceeds 1.2e-5.
+        out = v.summarize(rows(lambda i: dict(cd=5.58, cl=0.0106 + 1e-6 * i, p_diff=0.1174)))
+        self.assertEqual((out["status"], out["verdict"]), ("NOT_STEADY", None))
+        self.assertLessEqual(out["ranges"]["cl"], out["range_limits"]["cl"])
+        self.assertGreater(out["drifts"]["cl"], out["slope_limits"]["cl"])
+
+    def test_noise_range(self):
+        quiet = v.summarize(rows(lambda i: dict(cd=5.58, cl=0.0106 + 2e-5 * (i % 2), p_diff=0.1174)))
+        self.assertTrue(quiet["steady"])  # within the range limit, no trend
+        noisy = v.summarize(rows(lambda i: dict(cd=5.58, cl=0.0106 + 1e-4 * (i % 2), p_diff=0.1174)))
+        self.assertEqual(noisy["status"], "NOT_STEADY")
+        self.assertGreater(noisy["ranges"]["cl"], noisy["range_limits"]["cl"])
+
+    def test_incomplete_run_gives_no_verdict(self):
+        out = v.summarize(rows(lambda i: dict(cd=5.58, cl=0.0106, p_diff=0.1174), tstar_end=30))
+        self.assertEqual((out["status"], out["verdict"]), ("INCOMPLETE", None))
+
+
+class Re20Provenance(unittest.TestCase):
+    def test_records_current_checkout(self):
+        record = v.provenance(rr.DEFAULT_SOURCE)
+        self.assertEqual(record["source_mode"], "current_checkout")
+        self.assertEqual(len(record["checkout_revision"]), 40)
+        self.assertEqual(len(record["src_tree"]), 40)
+        self.assertEqual(len(record["runner_sha256"]), 64)
+        self.assertFalse(record["checkout_dirty"])
+        self.assertEqual(v.RESULT_SCHEMA, 2)
+
+    def test_reader_accepts_both_schemas_and_rejects_unknown(self):
+        import json
+        import tempfile
+        from pathlib import Path
+        case = dict(case="refined", status="NOT_STEADY", verdict=None, rows=[])
+        with tempfile.TemporaryDirectory() as d:
+            old, new, bad = Path(d, "old.json"), Path(d, "new.json"), Path(d, "bad.json")
+            old.write_text(json.dumps([case]))
+            new.write_text(json.dumps(dict(schema=2, provenance=dict(src_tree="a" * 40),
+                                           cases=[case])))
+            bad.write_text(json.dumps(dict(schema=3, cases=[case])))
+            self.assertEqual(v.read_result(old), dict(schema=1, provenance=None, cases=[case]))
+            self.assertEqual(v.read_result(new)["cases"][0], case)
+            self.assertEqual(v.read_result(new)["provenance"]["src_tree"], "a" * 40)
+            with self.assertRaisesRegex(ValueError, "unknown DFG Re20 result schema"):
+                v.read_result(bad)
+
+    def test_dirty_checkout_is_refused(self):
+        from unittest.mock import patch
+        # Three git calls in order: HEAD:src, HEAD, status --porcelain.
+        with patch("subprocess.check_output",
+                   side_effect=["e" * 40 + "\n", "f" * 40 + "\n", " M src/x.py\n"]) as git:
+            with self.assertRaisesRegex(RuntimeError, "clean checkout"):
+                v.provenance(rr.DEFAULT_SOURCE)
+        self.assertEqual(git.call_count, 3)
+        self.assertEqual([c.args[0][-1] for c in git.call_args_list[:2]], ["HEAD:src", "HEAD"])
+        self.assertIn("--porcelain", git.call_args_list[2].args[0])
+
+    def test_output_inside_checkout_is_refused_before_any_work(self):
+        import tempfile
+        from pathlib import Path
+        from unittest.mock import patch
+        source = rr.DEFAULT_SOURCE.resolve()
+        for output in (source, source / "re20-out", source / "src" / "x"):
+            argv = ["run_dfg_re20.py", "--plan", "--source", str(source), "--output", str(output)]
+            with patch("sys.argv", argv), \
+                 patch.object(v, "provenance", side_effect=AssertionError("work started")):
+                with self.assertRaisesRegex(SystemExit, "outside the source checkout"):
+                    v.main()
+        self.assertFalse((source / "re20-out").exists())
+        with tempfile.TemporaryDirectory() as d:
+            v.reject_output_inside(Path(d) / "out", source)  # outside: accepted
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_jet_circle_cv.py

@@ -166,7 +166,34 @@ class Host(unittest.TestCase):
         self.assertEqual(a["steps"] * 4, b["steps"])
 
     def test_source_pin(self):
-        verify(REPO)
+        """Historical integrity: the manifest matches its pinned commit, read with git."""
+        from run_jet_circle_cv import verify_historical
+        from source_provenance import HistoryUnavailable, history_unavailable
+        try:
+            verify_historical(REPO)
+        except HistoryUnavailable as error:
+            history_unavailable(self, error)
+
+    def test_pinned_mode_still_rejects_changed_source(self):
+        """Negative control: the frozen-source guard refuses a tree that differs from PIN."""
+        import json
+        import run_jet_circle_cv as v
+        manifest = json.loads((v.HERE / "data/jet_circle_cv/source_manifest.json").read_text())
+        import hashlib
+        current = {f: hashlib.sha256((REPO / f).read_bytes()).hexdigest()
+                   for f in manifest["files"] if (REPO / f).exists()}
+        if current == manifest["files"]:
+            self.skipTest("working tree equals PIN; no changed source to reject")
+        with self.assertRaisesRegex(RuntimeError, "Source hash mismatch"):
+            verify(REPO)
+
+    def test_current_checkout_provenance(self):
+        from run_jet_circle_cv import current_checkout
+        record = current_checkout(REPO)
+        self.assertEqual(record["source_mode"], "current_checkout")
+        self.assertIn("not the frozen", record["source_capture"])
+        self.assertEqual(len(record["src_tree"]), 40)
+        self.assertTrue(record["src_sha256"])
 
 
 if __name__ == "__main__":

tests/unit/test_les_flow_runner.py

@@ -13,8 +13,15 @@ from unittest.mock import patch
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "validation"))
 from run_uniform_les_flow import source_guard, decode_macros, HERE, HEADER
+from source_provenance import (HistoryUnavailable, historical_files, historical_sha256,
+                               historical_tree, history_unavailable)
 
 ROOT = HERE.parents[1]
+A135252 = "a135252ae78b47b57d7e77d19001700b3bedac8b"
+
+
+def a135252_pins():
+    return json.loads((HERE / "data/les_flow/source_pins_a135252.json").read_text())
 
 
 class GuardTests(unittest.TestCase):
@@ -41,20 +48,35 @@ class GuardTests(unittest.TestCase):
         with self.assertRaisesRegex(RuntimeError, "velocity/profile"):
             decode_macros(invalid, w, cx, cy)
 
-    def test_current_corrected_pins(self):
-        self.assertEqual(
-            source_guard(ROOT, "corrected", "a135252")["base_commit"],
-            "a135252ae78b47b57d7e77d19001700b3bedac8b",
-        )
+    def materialize(self, root):
+        """The pinned a135252 tree, read with git (the guard's own qualification)."""
+        try:
+            historical_files(ROOT, A135252, a135252_pins()["sources"], root)
+        except HistoryUnavailable as error:
+            history_unavailable(self, error)
 
-    def test_corrected_and_tamper_guard(self):
-        pins = json.loads((HERE / "data/les_flow/source_pins_a135252.json").read_text())
+    def test_a135252_pins_qualify_their_own_commit(self):
         with TemporaryDirectory() as directory:
             root = Path(directory)
-            for name in pins["sources"]:
-                dest = root / name
-                dest.parent.mkdir(parents=True, exist_ok=True)
-                shutil.copyfile(ROOT / name, dest)
+            self.materialize(root)
+            with patch("run_uniform_les_flow.subprocess.check_output",
+                       return_value="isolated-fixture\n"):
+                self.assertEqual(source_guard(root, "corrected", "a135252")["base_commit"], A135252)
+
+    def test_current_tree_is_not_the_a135252_qualification(self):
+        """Explicit record: the guard refuses today's src wherever it differs from the pin."""
+        pins = a135252_pins()["sources"]
+        changed = sorted(n for n, sha in pins.items() if (ROOT / n).exists()
+                         and hashlib.sha256((ROOT / n).read_bytes()).hexdigest() != sha)
+        if not changed:
+            self.skipTest("current src equals the a135252 pin")
+        with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
+            source_guard(ROOT, "corrected", "a135252")
+
+    def test_corrected_and_tamper_guard(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            self.materialize(root)
             with patch(
                 "run_uniform_les_flow.subprocess.check_output",
                 return_value="isolated-fixture\n",
@@ -85,25 +107,25 @@ class GuardTests(unittest.TestCase):
         with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
             source_guard(ROOT, "corrected")  # Omission still uses the historical profile.
 
-    def test_current_manifest_pins_actual_corrected_tree(self):
-        pins = json.loads((HERE / "data/les_flow/source_pins_a135252.json").read_text())
-        tracked = subprocess.check_output(["git", "-C", str(ROOT), "ls-files", "src"], text=True)
-        self.assertEqual(set(pins["sources"]), set(tracked.splitlines()))
-        for name, expected in pins["sources"].items():
-            self.assertEqual(hashlib.sha256((ROOT / name).read_bytes()).hexdigest(), expected)
+    def test_manifest_pins_the_a135252_corrected_tree(self):
+        pins = a135252_pins()
+        self.assertEqual(pins["base_commit"], A135252)
         self.assertEqual(pins["sources"][HEADER], pins["candidate_header_sha256"])
         self.assertNotEqual(pins["sources"][HEADER], pins["baseline_header_sha256"])
         with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
             source_guard(ROOT, "baseline", "a135252")
+        try:
+            names = historical_tree(ROOT, A135252)
+            actual = historical_sha256(ROOT, A135252, pins["sources"])
+        except HistoryUnavailable as error:
+            history_unavailable(self, error)
+        self.assertEqual(set(pins["sources"]), set(names))
+        self.assertEqual(actual, pins["sources"])
 
     def test_named_baseline_accepts_only_reversed_header(self):
-        pins = json.loads((HERE / "data/les_flow/source_pins_a135252.json").read_text())
         with TemporaryDirectory() as directory:
             root = Path(directory)
-            for name in pins["sources"]:
-                dest = root / name
-                dest.parent.mkdir(parents=True, exist_ok=True)
-                shutil.copyfile(ROOT / name, dest)
+            self.materialize(root)
             subprocess.run(["git", "apply", "--reverse", str(HERE / "les/data/smagorinsky_normalization.patch")], cwd=root, check=True)
             with patch("run_uniform_les_flow.subprocess.check_output", return_value="baseline-fixture\n"):
                 source_guard(root, "baseline", "a135252")

tests/unit/test_re100.py

@@ -62,13 +62,31 @@ def test_periodic_synthetic():
     assert not p.assess(rows()[:100])["periodic"]
 
 
-def test_production_unmodified():
+def test_manifest_matches_its_pinned_commit():
+    """Historical integrity only: the manifest describes the h.PIN tree (read with git)."""
     m = json.loads(
         (ROOT / "tests/validation/data/dfg_re100/source_manifest.json").read_text()
     )
     assert m["commit"] == h.PIN
-    for name, digest in m["production_sha256"].items():
-        assert hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == digest, name
+    import unittest
+    from source_provenance import HistoryUnavailable, history_unavailable, verify_manifest
+    try:
+        verify_manifest(ROOT, m["commit"], m["production_sha256"])
+    except HistoryUnavailable as error:
+        history_unavailable(unittest.TestCase(), error)
+
+
+def test_current_src_is_not_the_pinned_qualification():
+    """Explicit record: today's src differs from h.PIN, so its qualification does not carry over."""
+    m = json.loads(
+        (ROOT / "tests/validation/data/dfg_re100/source_manifest.json").read_text()
+    )
+    changed = sorted(n for n, d in m["production_sha256"].items()
+                     if not (ROOT / n).exists()
+                     or hashlib.sha256((ROOT / n).read_bytes()).hexdigest() != d)
+    if not changed:
+        pytest.skip("current src equals the pinned tree")
+    assert changed  # e.g. src/CelerisLab/lbm/channel.py since 47b05bc
 
 
 def test_reference():

tests/unit/test_refined_dfg.py

@@ -12,16 +12,33 @@ import run_refined_dfg as r
 h, periodic = r.helpers(r.DEFAULT_SOURCE)
 
 
+def historical_manifest(collision="SRT", observation_mode="last_base_step"):
+    """The manifest verify_source would select, without hashing the working tree.
+
+    Receipt/plan logic tests use it; source integrity is checked once in test_source_pin.
+    """
+    name = ("source_manifest_window.json" if observation_mode == "window" else
+            "source_manifest.json" if collision == "SRT" else "source_manifest_mrt.json")
+    return json.loads((r.HERE / "data/refined_dfg" / name).read_text())
+
+
 def test_source_pin():
-    historical = json.loads((r.HERE / "data/refined_dfg/source_manifest.json").read_text())
+    historical = historical_manifest("SRT")
     assert historical["commit"].startswith("cd3a657")
-    mrt_history = json.loads((r.HERE / "data/refined_dfg/source_manifest_mrt.json").read_text())
+    mrt_history = historical_manifest("MRT")
     assert mrt_history["commit"].startswith("3ea131e")
-    assert r.verify_source(r.DEFAULT_SOURCE, "MRT", "window")["commit"].startswith("a233c90")
-    with unittest.TestCase().assertRaisesRegex(RuntimeError, "Source mismatch"):
-        r.verify_source(r.DEFAULT_SOURCE, "MRT")
-    with unittest.TestCase().assertRaisesRegex(RuntimeError, "Source mismatch"):
-        r.verify_source(r.DEFAULT_SOURCE, "SRT")
+    assert historical_manifest("MRT", "window")["commit"].startswith("a233c90")
+    # Negative controls first, so missing history can never hide them: every pinned
+    # mode refuses a working tree that differs from its pin.
+    for collision, mode in (("MRT", "last_base_step"), ("SRT", "last_base_step"), ("MRT", "window")):
+        with unittest.TestCase().assertRaisesRegex(RuntimeError, "Source mismatch"):
+            r.verify_source(r.DEFAULT_SOURCE, collision, mode)
+    from source_provenance import HistoryUnavailable, history_unavailable, verify_manifest
+    for manifest in (historical, mrt_history, historical_manifest("MRT", "window")):
+        try:  # historical integrity: each manifest matches the tree of its own commit
+            verify_manifest(r.DEFAULT_SOURCE, manifest["commit"], manifest["sha256"])
+        except HistoryUnavailable as error:
+            history_unavailable(unittest.TestCase(), error)
 
 
 def test_matched_units_and_planes():
@@ -143,12 +160,13 @@ def test_axis_specific_sampling_phase():
 
 def test_full_requires_completed_pilot():
     with unittest.TestCase().assertRaisesRegex(ValueError, "pilot-results"):
-        r.verify_pilot(None, r.verify_source(r.DEFAULT_SOURCE, "MRT", "window"))
+        r.verify_pilot(None, historical_manifest("MRT", "window"))
 
 
 def pilot_fixture(path, observation_mode="window", jet_scenario="none", case_selection="both", uniform_diameter=80, placement="wide"):
     """Synthetic contract fixture only; never a physical result or run receipt."""
-    manifest = (r.verify_source(r.DEFAULT_SOURCE, "MRT", "window", jet_scenario)
+    manifest = ((historical_manifest("MRT", "window") if jet_scenario == "none" else
+                 r.verify_source(r.DEFAULT_SOURCE, "MRT", "window", jet_scenario))
                 if observation_mode == "window" else
                 json.loads((r.HERE / "data/refined_dfg/source_manifest_mrt.json").read_text()))
     selection = dict(case_selection=case_selection, uniform_diameter=uniform_diameter, placement=placement)
@@ -348,7 +366,7 @@ def test_record_actual_checkout_separately():
     actual = checkout_provenance(r.DEFAULT_SOURCE)
     assert len(actual["checkout_revision"]) == 40
     assert isinstance(actual["checkout_dirty"], bool)
-    assert r.verify_source(r.DEFAULT_SOURCE, "MRT", "window")["production_origin_commit"].startswith("d930")
+    assert historical_manifest("MRT", "window")["production_origin_commit"].startswith("d930")
 
 
 def test_window_plan_preserves_physics():
@@ -358,7 +376,7 @@ def test_window_plan_preserves_physics():
         assert baseline.pop("observation_mode") == "last_base_step"
         assert window.pop("observation_mode") == "window"
         assert baseline == window
-        assert r.verify_source(r.DEFAULT_SOURCE, collision, "window")["observation_mode"] == "window"
+        assert historical_manifest(collision, "window")["observation_mode"] == "window"
     with unittest.TestCase().assertRaises(ValueError):
         r.verify_source(r.DEFAULT_SOURCE, "MRT", "unknown")
 

tests/unit/test_validation_source_provenance.py

@@ -8,17 +8,19 @@ import sys
 
 ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(ROOT / "tests/validation"))
-from source_provenance import checkout_provenance
+import pytest
+from source_provenance import (HistoryUnavailable, checkout_provenance, historical_sha256,
+                               historical_tree, history_unavailable, verify_manifest)
+import unittest
 import re100_helpers
 import run_jet_circle_cv
 
 ORIGIN = "47b05bc8abfc957fe876b0c63bdb386e3c6cbaa5"
 
 
-def test_manifests_cover_current_source_and_preserve_origin():
-    names = subprocess.check_output(
-        ["git", "-C", str(ROOT), "ls-files", "src"], text=True
-    ).splitlines()
+def test_manifests_match_their_recorded_source_and_preserve_origin():
+    """Historical evidence integrity: each manifest describes the tree of its own commit."""
+    manifests = []
     for group, hashes_key, revision_key in (
         ("dfg_re100", "production_sha256", "commit"),
         ("jet_circle_cv", "files", "revision"),
@@ -28,18 +30,22 @@ def test_manifests_cover_current_source_and_preserve_origin():
                 ROOT / "tests/validation/data" / group / "source_manifest.json"
             ).read_text()
         )
+        # Structural checks need no history and always run.
         assert manifest[revision_key] == ORIGIN
-        assert set(manifest[hashes_key]) == set(names)
         assert manifest["source_origin_commits"][-1] == ORIGIN
         assert (
             manifest["historical_checkpoints"]["production"]
             == "d79e3f6f0a424f5bcc3a1a6d610313e49daf97a2"
         )
         assert "not inherited from d79" in manifest["experiment"]
-        for name, expected in manifest[hashes_key].items():
-            assert (
-                hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == expected
-            ), name
+        manifests.append(manifest[hashes_key])
+    try:
+        names = historical_tree(ROOT, ORIGIN)
+        for digests in manifests:
+            assert set(digests) == set(names)
+            verify_manifest(ROOT, ORIGIN, digests)
+    except HistoryUnavailable as error:
+        history_unavailable(unittest.TestCase(), error)
     assert re100_helpers.PIN == run_jet_circle_cv.PIN == ORIGIN
 
 
@@ -72,3 +78,36 @@ def test_runtime_checkout_identity_is_separate_from_source_origin(tmp_path):
     assert checkout_provenance(tmp_path) == dict(
         checkout_revision=expected, checkout_dirty=True
     )
+
+
+def test_historical_check_rejects_tampering_and_reports_missing_history(tmp_path):
+    with pytest.raises(HistoryUnavailable):
+        historical_sha256(tmp_path, ORIGIN, ["src/x.py"])  # not a repository
+    with pytest.raises(HistoryUnavailable):
+        historical_sha256(ROOT, "0" * 40, ["src/x.py"])  # commit absent
+    manifest = json.loads(
+        (ROOT / "tests/validation/data/dfg_re100/source_manifest.json").read_text())
+    digests = dict(manifest["production_sha256"])
+    name = sorted(digests)[0]
+    tampered = dict(digests, **{name: ("0" if digests[name][0] != "0" else "1") + digests[name][1:]})
+    try:
+        historical_tree(ROOT, ORIGIN)
+    except HistoryUnavailable as error:
+        history_unavailable(unittest.TestCase(), error)
+    with pytest.raises(RuntimeError, match="Historical manifest mismatch"):
+        verify_manifest(ROOT, ORIGIN, tampered)  # one flipped digest is caught
+    with pytest.raises(ValueError, match="not part of"):
+        historical_sha256(ROOT, ORIGIN, ["src/CelerisLab/does_not_exist.py"])
+
+
+def test_historical_files_reports_unreadable_blob_as_history_unavailable(tmp_path):
+    """A blob missing from the clone is HistoryUnavailable, not a raw CalledProcessError."""
+    import source_provenance
+    from unittest.mock import patch
+
+    missing = subprocess.CompletedProcess(["git", "show"], 128, b"", b"fatal: missing blob")
+    with patch.object(source_provenance, "historical_sha256", return_value={"src/a.py": "0" * 64}), \
+         patch.object(source_provenance.subprocess, "run", return_value=missing):
+        with pytest.raises(HistoryUnavailable, match="blob not in this clone"):
+            source_provenance.historical_files(ROOT, ORIGIN, ["src/a.py"], tmp_path)
+    assert not (tmp_path / "src/a.py").exists()

tests/validation/multigrid/test_refinement_three_level.py

@@ -80,11 +80,12 @@ class ThreeLevelCPU(unittest.TestCase):
         f, g = run._levels[1:]
         b = g.boundary
         events, feeds = [], []
-        advance, gather = run._advance_child, run._gather_halo
-        def record_feed(buffer, **kw):
-            self.assertIs(buffer, (f.current, f.spare)[len(feeds)])
-            feeds.append(buffer)
-            advance(buffer, **kw)
+        advance, gather = run._advance, run._gather_halo
+        def record_feed(index, buffer, **kw):  # index 2: L1 hop feeds L2
+            if index == 2:
+                self.assertIs(buffer, (f.current, f.spare)[len(feeds)])
+                feeds.append(buffer)
+            advance(index, buffer, **kw)
         def record_halo(level, buffer, **kw):
             if level is g:
                 events.append(("halo", buffer))
@@ -95,7 +96,7 @@ class ThreeLevelCPU(unittest.TestCase):
             self.assertIs(kind, g.kind)
             events.append(("step", src))
         g.kernel.side_effect = record_step
-        with patch.object(run, "_advance_child", side_effect=record_feed), \
+        with patch.object(run, "_advance", side_effect=record_feed), \
                 patch.object(run, "_gather_halo", side_effect=record_halo):
             run.step()
         self.assertEqual(feeds, [f.current, f.spare])
@@ -105,8 +106,8 @@ class ThreeLevelCPU(unittest.TestCase):
         self.assertGreater(len(np.unique(b.tables["block"])), 1)
         # Negative control: reusing L1's old source at the midpoint must fail.
         feeds.clear()
-        with patch.object(run, "_advance_child", side_effect=lambda buffer, **kw:
-                          record_feed(f.current, **kw)):
+        with patch.object(run, "_advance", side_effect=lambda index, buffer, **kw:
+                          record_feed(index, f.current if index == 2 else buffer, **kw)):
             with self.assertRaises(AssertionError):
                 run.step()
         run.close()
@@ -172,11 +173,12 @@ class ThreeLevelGPU(unittest.TestCase):
             p1, p2 = run.patch, run.child_patch
             run.initialize(state(16, 16, 1), state(*p1.fine_shape, 2), state(*p2.fine_shape, 3))
             f = run._levels[1]
-            feeds, original = [], run._advance_child
-            def record(buffer, **kw):
-                feeds.append(int(buffer))
-                original(buffer, **kw)
-            with patch.object(run, "_advance_child", side_effect=record):
+            feeds, original = [], run._advance
+            def record(index, buffer, **kw):  # index 2: L1 hop feeds L2
+                if index == 2:
+                    feeds.append(int(buffer))
+                original(index, buffer, **kw)
+            with patch.object(run, "_advance", side_effect=record):
                 cur, spare = int(f.current), int(f.spare)
                 run.step(1)
             self.assertEqual(feeds, [cur, spare])  # current G, then the new G of hop 1

tests/validation/run_dfg_re20.py

@@ -0,0 +1,267 @@
+"""Steady DFG 2D-1 (Re 20): refined and uniform runs against the official reference intervals.
+
+Not a full benchmark certification. Declared deviations from the official setup:
+pressure-NEQ outlet (``neq_extrap``) instead of do-nothing, local Zou-He inlet.
+Geometry, inflow profile, initial state, refined layout and observation reuse the
+pinned Re100 runner (``run_refined_dfg``) and ``re100_helpers`` unchanged; only the
+lattice viscosity is set for Re 20 (nu = U_lattice * D / 20 at the root level).
+
+Units. The helpers use scaled DFG units with mean inflow speed 1, so
+Cd = 2 Fx / (rho U^2 D) and Cl = 2 Fy / (rho U^2 D) are scale-free, and
+``pressure_probes`` returns dp / (rho U^2). The official p_diff = p(0.15, 0.2) -
+p(0.25, 0.2) uses U = 0.2 m/s, rho = 1, so p_diff = dp * 0.04. Both are reported;
+only p_diff is compared with the official interval. Forces use the existing sign
+convention: F is the force of the fluid on the cylinder, i.e. the refined raw
+exchange impulse (window ledger, ``total.impulse``) or the uniform ``read_force``,
+with x along the inflow and y up from the bottom wall. Cd must be positive, and the
+official Cl is positive (centre 0.20 below the centreline 0.205), so a flipped sign
+shows up as Cl outside its interval.
+
+Sampling. One sample every SAMPLE_TSTAR (t* = U t / D; 0.25 s), taken at the end of
+a completed root step with all levels synchronized; the step index is recorded. Cd
+and Cl are means over the sample interval (window exchange ledger refined, per-batch
+forces uniform), which filters acoustic and step-parity oscillation; p_diff is the
+end-of-interval value at the exact surface points.
+
+Steady rule (our engineering choice, frozen before any run; not official). Over the
+trailing WINDOW_TSTAR (t* 50..60 inclusive, 21 samples), for each of Cd, Cl and
+p_diff: range (max - min) <= 10 % and |least-squares slope * window| <= 2 % of the
+width of its official interval. Absolute limits, so the small Cl is never a divisor;
+the slope term bounds slow monotone drift that the range alone would pass. If the
+rule fails at TSTAR_MAX the run reports "not steady" and gives no interval verdict;
+limits are never relaxed after a run. The verdict uses the window mean, and the
+distance of each mean to its nearest interval edge is reported (negative outside).
+"""
+
+import argparse
+import json
+import math
+import os
+from pathlib import Path
+import sys
+import time
+from tempfile import TemporaryDirectory
+
+import numpy as np
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+import run_refined_dfg as rr  # noqa: E402
+
+RE = 20.0
+U_PHYS = 0.2                   # m/s mean inflow; rho = 1
+TSTAR_MAX = 60.0               # 30 s physical
+SAMPLE_TSTAR = 0.5             # 0.25 s
+WINDOW_TSTAR = 10.0            # trailing 5 s, 21 samples
+# Schaefer & Turek (1996), 2D-1 lower/upper bounds.
+BANDS = dict(cd=(5.57, 5.59), cl=(0.0104, 0.0110), p_diff=(0.1172, 0.1176))
+STEADY_RANGE = {k: (hi - lo) / 10 for k, (lo, hi) in BANDS.items()}
+STEADY_SLOPE = {k: (hi - lo) / 50 for k, (lo, hi) in BANDS.items()}
+# 2: {schema, provenance, cases}; the earlier receipts (schema 1) are a bare list of cases.
+RESULT_SCHEMA = 2
+DEVIATIONS = ("pressure-NEQ outlet (neq_extrap), not do-nothing", "local Zou-He inlet")
+
+_re100_config = rr.config
+
+
+def config(h, diameter, collision="SRT", jet_scenario="none"):
+    """The pinned Re100 configuration with the lattice viscosity set for Re 20."""
+    if jet_scenario != "none":
+        raise ValueError("DFG 2D-1 runs have no Jets")
+    cfg, body, p = _re100_config(h, diameter, collision, jet_scenario)
+    nu = p["mean_speed"] * p["diameter"] / RE
+    cfg["physics"]["viscosity"] = nu
+    return cfg, body, dict(p, viscosity=nu, re=RE)
+
+
+def lattice_parameters(diameter, speed=rr.SPEED):
+    nu = speed * diameter / RE
+    return dict(viscosity=nu, tau=0.5 + 3 * nu, steps=math.ceil(TSTAR_MAX * diameter / speed),
+                interval=round(SAMPLE_TSTAR * diameter / speed))
+
+
+def sample(impulse, n, diameter, dp):
+    den = rr.SPEED**2 * diameter / 2
+    return dict(cd=float(impulse[0] / n / den), cl=float(impulse[1] / n / den),
+                dp_scaled=float(dp), p_diff=float(dp) * U_PHYS**2)
+
+
+def summarize(rows):
+    """Steady rule over the trailing window, then the interval verdict (or none)."""
+    if not rows or rows[-1]["tstar"] < TSTAR_MAX - 1e-9:
+        return dict(status="INCOMPLETE", steady=False, verdict=None)
+    window = [r for r in rows if r["tstar"] >= TSTAR_MAX - WINDOW_TSTAR - 1e-9]
+    t = np.array([r["tstar"] for r in window])
+    ranges = {k: max(r[k] for r in window) - min(r[k] for r in window) for k in BANDS}
+    drifts = {k: abs(np.polyfit(t, [r[k] for r in window], 1)[0]) * WINDOW_TSTAR for k in BANDS}
+    steady = all(ranges[k] <= STEADY_RANGE[k] and drifts[k] <= STEADY_SLOPE[k] for k in BANDS)
+    final = {k: float(np.mean([r[k] for r in window])) for k in BANDS}
+    edge = {k: min(final[k] - BANDS[k][0], BANDS[k][1] - final[k]) for k in BANDS}
+    result = dict(window_samples=len(window), ranges=ranges, drifts=drifts,
+                  range_limits=STEADY_RANGE, slope_limits=STEADY_SLOPE, steady=steady,
+                  window_mean=final, edge_distance=edge, bands=BANDS,
+                  deviations=DEVIATIONS, cd_positive=final["cd"] > 0)
+    if not steady:
+        return dict(result, status="NOT_STEADY", verdict=None)
+    inside = {k: BANDS[k][0] <= final[k] <= BANDS[k][1] for k in BANDS}
+    return dict(result, status="WITHIN_INTERVALS" if all(inside.values()) else "OUTSIDE_INTERVALS",
+                verdict=inside)
+
+
+def read_result(path):
+    """Cases and provenance from a result.json of either schema.
+
+    Schema 1 (receipts before RESULT_SCHEMA=2, e.g. evidence 70f6617) is a bare list of
+    cases without provenance; schema 2 is {schema, provenance, cases}. Readers that
+    indexed [0] on schema 1 must use read_result(path)["cases"][0].
+    """
+    data = json.loads(Path(path).read_text())
+    if isinstance(data, list):
+        return dict(schema=1, provenance=None, cases=data)
+    if not isinstance(data, dict) or data.get("schema") != RESULT_SCHEMA:
+        raise ValueError(f"unknown DFG Re20 result schema: {data.get('schema') if isinstance(data, dict) else type(data).__name__}")
+    return dict(schema=RESULT_SCHEMA, provenance=data["provenance"], cases=data["cases"])
+
+
+def healthy(row):
+    return row["max_mach"] <= 0.2 and row["rho_min"] >= 0.5 and row["rho_max"] <= 1.5
+
+
+def run_case(a, h, case):
+    from contextlib import ExitStack
+    from CelerisLab.cuda.context import CudaContext
+    from CelerisLab.lbm.descriptors import FLUID
+    from CelerisLab.lbm.refinement_stepper import FixedPatchStepper
+    from CelerisLab.simulation import Simulation
+
+    refined = case == "refined"
+    cfgdict, bodydict, p = config(h, 40 if refined else 80, a.collision)
+    lp = lattice_parameters(p["diameter"])
+    rows = []
+    with ExitStack() as stack:
+        if refined:
+            cfg, pair, body, host = rr.host_geometry(a.source, h, a.collision)
+            context = stack.enter_context(CudaContext(0))
+            backend = stack.enter_context(FixedPatchStepper(
+                cfg, rr.PLACEMENTS["wide"], context=context, coarse_boundary="channel",
+                base_block=rr.BASE_BLOCK, fine_block=rr.FINE_BLOCK, fine_objects=(body,),
+                observe_raw_exchange=True, observe_window_exchange=True))
+            from CelerisLab.lbm.channel import channel_masks
+            from CelerisLab.lbm.refinement import ACTIVE
+            from CelerisLab.lbm.descriptors import SOLID
+            masks = [channel_masks(pair.coarse_shape)[0] & ~pair.covered,
+                     (pair.fine_kind == ACTIVE)
+                     & ((host.flags.reshape(pair.fine_shape) & SOLID) == 0)]
+            backend.initialize(rr.initial_state(pair.coarse_shape, (0.0, 0.0), 1.0, root=True),
+                               rr.initial_state(pair.fine_shape, pair.fine_origin, 0.5))
+            probe_p = dict(p, center=[(80.5 - pair.fine_origin[0]) / 0.5 - 0.5,
+                                      (81.0 - pair.fine_origin[1]) / 0.5 - 0.5], radius=40.0)
+        else:
+            tmp = Path(stack.enter_context(TemporaryDirectory()))
+            (tmp / "lbm.json").write_text(json.dumps(cfgdict))
+            (tmp / "body.json").write_text(json.dumps(bodydict))
+            sim = stack.enter_context(Simulation(str(tmp / "lbm.json"), str(tmp / "body.json"),
+                                                 device_id=0))
+            sim.initialize()
+            probe_p = p
+            fluid = (sim.field.flag.reshape(p["ny"], p["nx"]) & FLUID) != 0
+        begin = 0
+        while begin < lp["steps"]:
+            rr.check_deadline(a.deadline)
+            n = min(lp["interval"], lp["steps"] - begin)
+            if refined:
+                impulse = rr.advance_refined_interval(backend, n, a.deadline, "window")
+                fields = [rr.macros(g) for g in backend.download()]
+                rho, ux, uy = fields[1]
+                fluid = masks[1]
+                vals = [tuple(v[m] for v in f) for m, f in zip(masks, fields)]
+            else:
+                impulse, done = np.zeros(2), 0
+                while done < n:
+                    batch = min(100, n - done)
+                    sim.run(batch)
+                    impulse += sim.read_force(0).astype(np.float64) * batch
+                    done += batch
+                m = sim.get_macroscopic()
+                rho, ux, uy = [np.asarray(m[k], np.float64).reshape(p["ny"], p["nx"])
+                               for k in ("rho", "ux", "uy")]
+                vals = [(rho[fluid], ux[fluid], uy[fluid])]
+            begin += n
+            row = dict(step=begin, tstar=begin * rr.SPEED / p["diameter"],
+                       **sample(impulse, n, p["diameter"],
+                                h.pressure_probes(rho, fluid, probe_p)["dp"]),
+                       rho_min=float(min(v[0].min() for v in vals)),
+                       rho_max=float(max(v[0].max() for v in vals)),
+                       max_mach=float(max(np.sqrt(3 * (v[1]**2 + v[2]**2)).max() for v in vals)))
+            rr.ensure_finite(row)
+            rows.append(row)
+            if not healthy(row):
+                break
+    summary = summarize(rows) if healthy(rows[-1]) else dict(status="UNHEALTHY", steady=False,
+                                                             verdict=None)
+    return dict(case=case, collision=a.collision, lattice=lp, rows=rows, **summary)
+
+
+def plan(collision="SRT"):
+    return dict(re=RE, collision=collision, tstar_max=TSTAR_MAX, sample_tstar=SAMPLE_TSTAR,
+                window_tstar=WINDOW_TSTAR, bands=BANDS, range_limits=STEADY_RANGE, slope_limits=STEADY_SLOPE,
+                deviations=DEVIATIONS, pressure_scale=U_PHYS**2,
+                refined_root=lattice_parameters(40), refined_fine_tau=0.5 + 3 * 2 * rr.SPEED * 40 / RE,
+                uniform=lattice_parameters(80),
+                label="compared against the official reference bands (non-canonical neq_extrap outlet, zou_he_local inlet); not a full benchmark certification")
+
+
+def provenance(source):
+    """Current checkout identity: HEAD, dirty flag, src tree and this runner's hash."""
+    import hashlib
+    import subprocess
+    from source_provenance import checkout_provenance
+    tree = subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD:src"],
+                                   text=True).strip()
+    record = dict(source_mode="current_checkout", **checkout_provenance(source), src_tree=tree,
+                  runner_sha256=hashlib.sha256(Path(__file__).read_bytes()).hexdigest())
+    if record["checkout_dirty"]:  # HEAD would not describe the code that runs
+        raise RuntimeError("DFG Re20 runs require a clean checkout")
+    return record
+
+
+def reject_output_inside(output, source):
+    """Receipts inside the checkout would make it dirty and change the recorded source."""
+    output = Path(output).resolve()
+    if output == source or source in output.parents:
+        raise SystemExit(f"--output must be outside the source checkout {source}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--case", choices=["refined", "uniform", "both"], default="refined")
+    parser.add_argument("--collision", choices=["SRT", "MRT"], default="SRT")
+    parser.add_argument("--source", type=Path, default=rr.DEFAULT_SOURCE)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--plan", action="store_true", help="Write the frozen plan; no CUDA")
+    parser.add_argument("--max-wall-seconds", type=float)
+    a = parser.parse_args()
+    a.source = a.source.resolve()
+    reject_output_inside(a.output, a.source)
+    record = dict(plan(a.collision), schema=RESULT_SCHEMA, provenance=provenance(a.source))
+    a.output.mkdir(parents=True, exist_ok=False)
+    (a.output / "plan.json").write_text(json.dumps(record, indent=2, allow_nan=False))
+    if a.plan:
+        return
+    if not a.max_wall_seconds or a.max_wall_seconds <= 0 or not os.environ.get("CUDA_VISIBLE_DEVICES"):
+        raise SystemExit("GPU run needs --max-wall-seconds > 0 and explicit CUDA_VISIBLE_DEVICES")
+    h, _ = rr.helpers(a.source)
+    rr.config = config  # host_geometry builds its root configuration through this name
+    a.deadline = time.monotonic() + a.max_wall_seconds
+    cases = ["refined", "uniform"] if a.case == "both" else [a.case]
+    results = [run_case(a, h, case) for case in cases]
+    after = provenance(a.source)
+    if after != record["provenance"]:
+        raise RuntimeError("Source checkout changed during the run")
+    (a.output / "result.json").write_text(json.dumps(dict(schema=RESULT_SCHEMA, provenance=after,
+                                                          cases=results),
+                                                     indent=2, allow_nan=False))
+
+
+if __name__ == "__main__":
+    main()

tests/validation/run_jet_circle_cv.py

@@ -3,6 +3,7 @@
 
 import argparse
 import hashlib
+import subprocess
 import json
 import os
 from pathlib import Path
@@ -220,6 +221,29 @@ def verify(repo):
     return manifest
 
 
+def verify_historical(repo):
+    """The pinned manifest describes the PIN tree (read with git, not the working tree)."""
+    from source_provenance import verify_manifest
+    manifest = json.loads((HERE / "data/jet_circle_cv/source_manifest.json").read_text())
+    if manifest["revision"] != PIN:
+        raise RuntimeError("Wrong pinned revision")
+    verify_manifest(repo, PIN, manifest["files"])
+    return manifest
+
+
+def current_checkout(repo):
+    """Provenance for a run on the current checkout; never labelled as the pinned source."""
+    files = subprocess.check_output(["git", "-C", str(repo), "ls-files", "src"],
+                                    text=True).splitlines()
+    return dict(source_mode="current_checkout",
+                source_capture="current checkout, not the frozen pinned qualification",
+                source_revision=checkout_provenance(repo)["checkout_revision"],
+                src_tree=subprocess.check_output(["git", "-C", str(repo), "rev-parse",
+                                                  "HEAD:src"], text=True).strip(),
+                src_sha256={f: hashlib.sha256((repo / f).read_bytes()).hexdigest()
+                            for f in files})
+
+
 def run_case(c, ctx, output, provenance, continuation=False):
     from CelerisLab.body.geometry.circle import CircleGeometry
     from CelerisLab.body.objects import SimObject
@@ -530,8 +554,7 @@ def run_case(c, ctx, output, provenance, continuation=False):
                     recorder.flush()
                 payload = dict(
                     case=c,
-                    source_revision=PIN,
-                    **provenance,
+                    **{"source_revision": PIN, **provenance},
                     status="PILOT_DIAGNOSTIC_ONLY",
                     windows=rows,
                     physics_validation_pass=False,
@@ -571,6 +594,9 @@ def main():
         help="Fixed measurement campaign: Re100, scale1/2, 3200 reference steps",
     )
     p.add_argument("--plan", action="store_true")
+    p.add_argument("--current-checkout", action="store_true",
+                   help="Run on the current clean checkout and record its provenance "
+                        "instead of requiring the frozen pinned source")
     a = p.parse_args()
     if a.steps <= 0 or a.steps > 3200:
         p.error("steps must be 1..3200")
@@ -595,7 +621,8 @@ def main():
         )
     plan = dict(
         case=c,
-        required_revision=PIN,
+        required_revision=None if a.current_checkout else PIN,
+        source_mode="current_checkout" if a.current_checkout else "pinned",
         required_free_device_mib=1024,
         estimated_peak_device_mib=128 * a.scale**2,
         estimated_output_mib=64 if a.continuation else 2,
@@ -611,10 +638,16 @@ def main():
     ):
         p.error("Root must select one verified idle GPU via CUDA_VISIBLE_DEVICES")
     repo = a.repo.resolve()
-    source = verify(repo)
-    provenance = dict(
-        source_experiment=source["experiment"], **checkout_provenance(repo)
-    )
+    if a.current_checkout:
+        provenance = dict(**checkout_provenance(repo), **current_checkout(repo))
+        if provenance["checkout_dirty"]:
+            raise RuntimeError("Current-checkout runs require a clean checkout")
+    else:
+        source = verify(repo)
+        provenance = dict(
+            source_experiment=source["experiment"], source_mode="pinned",
+            **checkout_provenance(repo)
+        )
     sys.path.insert(0, str(repo / "src"))
     import CelerisLab
 

tests/validation/source_provenance.py

@@ -13,3 +13,74 @@ def checkout_provenance(repo):
         text=True,
     )
     return dict(checkout_revision=revision, checkout_dirty=bool(dirty))
+
+
+class HistoryUnavailable(RuntimeError):
+    """The clone cannot show the recorded commit (no git, shallow clone, installed copy)."""
+
+
+def historical_sha256(repo, commit, paths):
+    """SHA-256 of each path as stored in `commit`, read with git, never from the working tree.
+
+    Raises HistoryUnavailable when git or the commit object is missing, so callers can
+    report an unchecked integrity record explicitly instead of passing or failing silently.
+    """
+    import hashlib
+    git = ["git", "-C", str(repo)]
+    try:
+        subprocess.run([*git, "cat-file", "-e", f"{commit}^{{commit}}"], check=True,
+                       capture_output=True)
+    except (OSError, subprocess.CalledProcessError) as error:
+        raise HistoryUnavailable(f"commit {commit} is not available in {repo}") from error
+    digests = {}
+    for path in paths:
+        listed = subprocess.run([*git, "ls-tree", "--name-only", commit, "--", path],
+                                capture_output=True, text=True)
+        if listed.returncode:
+            raise HistoryUnavailable(f"tree of {commit} is not available in {repo}")
+        if listed.stdout.strip() != path:
+            raise ValueError(f"{path} is not part of {commit}")
+        shown = subprocess.run([*git, "show", f"{commit}:{path}"], capture_output=True)
+        if shown.returncode:  # e.g. a blobless partial clone without network access
+            raise HistoryUnavailable(f"content of {path} at {commit} is not available in {repo}")
+        digests[path] = hashlib.sha256(shown.stdout).hexdigest()
+    return digests
+
+
+def verify_manifest(repo, commit, digests):
+    """Raise RuntimeError naming the first path whose recorded digest differs at `commit`."""
+    actual = historical_sha256(repo, commit, digests)
+    for path, digest in digests.items():
+        if actual[path] != digest:
+            raise RuntimeError(f"Historical manifest mismatch at {commit}: {path}")
+    return actual
+
+
+def historical_tree(repo, commit, prefix="src"):
+    """Tracked file names under `prefix` at `commit` (HistoryUnavailable if missing)."""
+    historical_sha256(repo, commit, [])
+    return subprocess.check_output(["git", "-C", str(repo), "ls-tree", "-r", "--name-only",
+                                    commit, "--", prefix], text=True).splitlines()
+
+
+def historical_files(repo, commit, paths, dest):
+    """Write each path as stored in `commit` under `dest` (HistoryUnavailable if missing)."""
+    from pathlib import Path
+    historical_sha256(repo, commit, paths)  # HistoryUnavailable / ValueError before writing
+    for path in paths:
+        shown = subprocess.run(["git", "-C", str(repo), "show", f"{commit}:{path}"],
+                               capture_output=True)
+        if shown.returncode:
+            raise HistoryUnavailable(f"cannot read {commit}:{path} (blob not in this clone)")
+        target = Path(dest) / path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(shown.stdout)
+
+
+def history_unavailable(testcase, error):
+    """Skip with the reason, or fail when CELERIS_REQUIRE_HISTORY=1 (release gating)."""
+    import os
+    message = f"historical integrity NOT checked: {error}"
+    if os.environ.get("CELERIS_REQUIRE_HISTORY") == "1":
+        raise AssertionError(message)
+    testcase.skipTest(message)

tests/validation/taylor_green/assess_projected_pairs.py

@@ -73,7 +73,10 @@ def valid_builds(record, n, depth):
     return True
 
 
-def assess(records, expected_revision=None):
+def assess(records, expected_revision=None, current=False):
+    """current=True assesses current-checkout receipts (run_case --current-checkout) with
+    the same gates; it never accepts them as the frozen a135252 qualification, and the
+    frozen mode never accepts current-checkout receipts."""
     indexed, duplicates = {}, []
     for record in records:
         key = tuple(record.get(k) for k in ("re_L", "n", "depth", "explosion"))
@@ -87,11 +90,19 @@ def assess(records, expected_revision=None):
     sources = [r.get("source", {}) for r in records]
     checks["same_source_and_harness"] = bool(sources) and len({
         json.dumps(s, sort_keys=True) for s in sources}) == 1
-    checks["clean_a135252_numerical_source"] = bool(sources) and all(
-        s.get("dirty") is False and s.get("source_tree_sha256") == SOURCE_SHA256
-        and bool(s.get("revision")) and bool(s.get("harness_sha256"))
-        and s.get("build_capture_sha256") == BUILD_CAPTURE_SHA256
-        and (expected_revision is None or s.get("revision") == expected_revision) for s in sources)
+    if current:
+        checks["clean_current_checkout_source"] = bool(sources) and expected_revision is not None and all(
+            s.get("dirty") is False and s.get("source_mode") == "current_checkout"
+            and bool(s.get("source_tree_sha256")) and bool(s.get("harness_sha256"))
+            and s.get("build_capture_sha256") == BUILD_CAPTURE_SHA256
+            and s.get("revision") == expected_revision for s in sources)
+    else:
+        checks["clean_a135252_numerical_source"] = bool(sources) and all(
+            s.get("dirty") is False and s.get("source_tree_sha256") == SOURCE_SHA256
+            and "source_mode" not in s
+            and bool(s.get("revision")) and bool(s.get("harness_sha256"))
+            and s.get("build_capture_sha256") == BUILD_CAPTURE_SHA256
+            and (expected_revision is None or s.get("revision") == expected_revision) for s in sources)
     runtimes = [r.get("runtime_identity") for r in records]
     checks["same_recorded_runtime"] = bool(runtimes) and all(
         isinstance(v, dict) and all(v.get(k) for k in
@@ -125,8 +136,14 @@ def assess(records, expected_revision=None):
             and r.get("mach") == U * math.sqrt(3)
         )
         checks[label + " actual_builds"] = valid_builds(r, n, depth)
-        checks[label + " reference"] = (r.get("numerical_revision") == NUMERICAL_REVISION
-                                         and r.get("reference_harness") == REFERENCE_HARNESS)
+        if current:
+            checks[label + " reference"] = (r.get("numerical_revision") is None
+                                             and r.get("source_mode") == "current_checkout"
+                                             and r.get("reference_harness") == REFERENCE_HARNESS)
+        else:
+            checks[label + " reference"] = (r.get("numerical_revision") == NUMERICAL_REVISION
+                                             and "source_mode" not in r
+                                             and r.get("reference_harness") == REFERENCE_HARNESS)
         checks[label + " numerics"] = r.get("numerics") == NUMERICS and r.get("initialization") == INITIALIZATION
         runtime = r.get("runtime_source", {})
         package = Path(runtime.get("checkout", "")) / "src/CelerisLab"
@@ -185,7 +202,10 @@ def assess(records, expected_revision=None):
                                      valid_case_and_controls=valid, baseline_passed=baseline_passed)
     return dict(passed=all(checks.values()), missing=missing, duplicates=duplicates, checks=checks,
                 comparisons=comparisons, scheme_results=scheme_results, early_pressure=early,
-                numerical_revision=NUMERICAL_REVISION, source_tree_sha256=SOURCE_SHA256,
+                source_mode="current_checkout" if current else "frozen",
+                numerical_revision=None if current else NUMERICAL_REVISION,
+                source_tree_sha256=(sources[0].get("source_tree_sha256") if current and sources
+                                    else None if current else SOURCE_SHA256),
                 reference_harness=REFERENCE_HARNESS, expected_revision=expected_revision,
                 floors=FLOORS, baseline_factor=BASELINE_FACTOR,
                 main_statistic="maximum of four post-initial samples at t*=.12,.24,.36,.48",
@@ -199,10 +219,13 @@ if __name__ == "__main__":
     p.add_argument("files", type=Path, nargs="+")
     p.add_argument("--output", type=Path, required=True)
     p.add_argument("--expected-revision", required=True)
+    p.add_argument("--current-checkout", action="store_true",
+                   help="assess current-checkout receipts; never the frozen qualification")
     args = p.parse_args()
     if args.output.exists():
         p.error("Output already exists; choose a new path to retain prior evidence")
-    result = assess([json.loads(path.read_text()) for path in args.files], args.expected_revision)
+    result = assess([json.loads(path.read_text()) for path in args.files], args.expected_revision,
+                    current=args.current_checkout)
     args.output.write_text(json.dumps(result, indent=2, allow_nan=False) + "\n")
     print(json.dumps(result, indent=2, allow_nan=False))
     raise SystemExit(0 if result["passed"] else 1)

tests/validation/taylor_green/run_case.py

@@ -64,8 +64,16 @@ def provenance(repo):
     )
 
 
-def verify_source(repo, revision):
-    """Exact clean harness commit, fixed production tree, and reviewed capture helper."""
+CURRENT_CAPTURE = "current checkout, not the frozen a135252 qualification"
+
+
+def verify_source(repo, revision, current=False):
+    """Exact clean harness commit, fixed production tree, and reviewed capture helper.
+
+    current=True records the clean checkout itself instead of requiring the frozen
+    numerical tree; such receipts carry source_mode="current_checkout" and are only
+    assessed with assess(..., current=True), never as the frozen qualification.
+    """
     import oracle
     from tests.validation.multigrid import check_projected_pairs as gate
 
@@ -77,6 +85,17 @@ def verify_source(repo, revision):
     if (Path(gate.__file__).resolve() != helper
             or hashlib.sha256(helper.read_bytes()).hexdigest() != BUILD_CAPTURE_SHA256):
         raise RuntimeError("Wrong build-capture helper")
+    if current:
+        result = provenance(repo)
+        if result["revision"] != revision or result["dirty"]:
+            raise ValueError("requires the exact expected clean checkout")
+        result.update(source_mode="current_checkout", source_capture=CURRENT_CAPTURE,
+                      build_capture_sha256=BUILD_CAPTURE_SHA256)
+        return result
+    if subprocess.run(["git", "-C", str(repo), "cat-file", "-e", f"{NUMERICAL_REVISION}^{{commit}}"],
+                      capture_output=True).returncode:
+        raise RuntimeError(f"frozen numerical revision {NUMERICAL_REVISION} is not available "
+                           "in this clone; the frozen qualification cannot be checked")
     if gate.preflight(repo, revision, "candidate") != NUMERICAL_REVISION:
         raise RuntimeError("Wrong production revision")
     result = provenance(repo)
@@ -149,6 +168,8 @@ def main():
     p.add_argument("--depth", type=int, choices=[1, 2, 3], required=True)
     p.add_argument("--output", type=Path, required=True)
     p.add_argument("--explosion", choices=["constant", "projected_linear"], default="constant")
+    p.add_argument("--current-checkout", action="store_true",
+                   help="record the clean current checkout instead of the frozen a135252 tree")
     p.add_argument("--early-pressure", action="store_true",
                    help="also save 65 scalar pressure samples at t*=k*.001875, k=0..64")
     args = p.parse_args()
@@ -161,7 +182,7 @@ def main():
         p.error("--run-gpu and exactly one explicit CUDA_VISIBLE_DEVICES are required")
     repo = args.repo.resolve()
     sys.path[:0] = [str(repo / "src"), str(repo)]
-    source = verify_source(repo, args.expected_revision)
+    source = verify_source(repo, args.expected_revision, current=args.current_checkout)
     runtime = runtime_source(repo)
     if args.dry_run:
         print(json.dumps(dict(source=source, runtime_source=runtime, dry_run=True)))
@@ -182,7 +203,8 @@ def main():
     report = dict(
         schema=1,
         source=source,
-        numerical_revision=NUMERICAL_REVISION,
+        numerical_revision=None if args.current_checkout else NUMERICAL_REVISION,
+        **({"source_mode": "current_checkout"} if args.current_checkout else {}),
         reference_harness=REFERENCE_HARNESS,
         actual_build_sidecars=[],
         runtime_identity=None,

tests/validation/taylor_green/test_projected_pairs.py

@@ -291,6 +291,48 @@ class ProjectedPairsTests(unittest.TestCase):
                 else:
                     self.assertEqual(run_case.verify_source(REPO, expected), source())
 
+    def test_frozen_mode_reports_missing_history_not_a_diff(self):
+        from tests.validation.multigrid import check_projected_pairs as gate
+        missing = SimpleNamespace(returncode=128)
+        with patch.object(run_case.subprocess, "run", return_value=missing), \
+             patch.object(gate, "preflight") as preflight:
+            with self.assertRaisesRegex(RuntimeError, "not available in this clone"):
+                run_case.verify_source(REPO, MOCK_REVISION)
+            preflight.assert_not_called()
+
+    def test_current_checkout_source_is_recorded_not_frozen(self):
+        from tests.validation.multigrid import check_projected_pairs as gate
+        current = dict(source(), source_tree_sha256="c" * 64)
+        with patch.object(run_case, "provenance", return_value=dict(current)), \
+             patch.object(gate, "preflight") as preflight:
+            result = run_case.verify_source(REPO, MOCK_REVISION, current=True)
+            preflight.assert_not_called()
+        self.assertEqual(result["source_mode"], "current_checkout")
+        self.assertEqual(result["source_capture"], run_case.CURRENT_CAPTURE)
+        for bad in (dict(current, dirty=True), dict(current, revision=OLD_REVISION)):
+            with self.subTest(bad=bad), patch.object(run_case, "provenance", return_value=bad):
+                with self.assertRaisesRegex(ValueError, "exact expected clean checkout"):
+                    run_case.verify_source(REPO, MOCK_REVISION, current=True)
+
+    def test_current_and_frozen_receipts_never_cross_assess(self):
+        frozen = records()
+        current = deepcopy(frozen)
+        for r in current:
+            r["source"] = dict(r["source"], source_tree_sha256="c" * 64,
+                               source_mode="current_checkout",
+                               source_capture=run_case.CURRENT_CAPTURE)
+            r["numerical_revision"], r["source_mode"] = None, "current_checkout"
+        ok = assess(current, MOCK_REVISION, current=True)
+        self.assertTrue(ok["checks"]["clean_current_checkout_source"])
+        self.assertTrue(all(v for k, v in ok["checks"].items() if k.endswith(" reference")))
+        self.assertEqual((ok["source_mode"], ok["numerical_revision"]), ("current_checkout", None))
+        self.assertEqual(ok["source_tree_sha256"], "c" * 64)
+        self.assertFalse(assess(current, MOCK_REVISION)["checks"]["clean_a135252_numerical_source"])
+        self.assertFalse(assess(current, MOCK_REVISION)["passed"])
+        self.assertFalse(assess(frozen, MOCK_REVISION, current=True)["checks"]["clean_current_checkout_source"])
+        self.assertFalse(assess(current, None, current=True)["checks"]["clean_current_checkout_source"])
+        self.assertTrue(assess(frozen, MOCK_REVISION)["checks"]["clean_a135252_numerical_source"])
+
     def test_explicit_opt_in_selector_and_dry_run_without_cuda(self):
         with tempfile.TemporaryDirectory() as tmp:
             output = Path(tmp) / "case.json"
@@ -319,7 +361,7 @@ class ProjectedPairsTests(unittest.TestCase):
                  patch.object(run_case, "runtime_identity", side_effect=AssertionError("CUDA reached")), \
                  redirect_stdout(stdout):
                 self.assertEqual(run_case.main(), 0)
-            verify.assert_called_once_with(REPO, MOCK_REVISION)
+            verify.assert_called_once_with(REPO, MOCK_REVISION, current=False)
             self.assertTrue(json.loads(stdout.getvalue())["dry_run"])
             self.assertFalse(output.exists())
 
@@ -412,7 +454,7 @@ class ProjectedPairsTests(unittest.TestCase):
                     else:
                         self.assertEqual(run_case.main(), 0)
                 receipt = json.loads(output.read_text())
-                verify.assert_called_once_with(REPO, MOCK_REVISION)
+                verify.assert_called_once_with(REPO, MOCK_REVISION, current=False)
                 self.assertEqual(selectors, ["projected_linear" if early else "constant"] if depth == 2 else [])
                 self.assertEqual(receipt["source"], source())
                 self.assertEqual(receipt["runtime_identity"], RUNTIME)