diff --git a/README.md b/README.md
index f228ba9..a27aa81 100644
--- a/README.md
+++ b/README.md
@@ -130,6 +130,8 @@ script. With neither, it reports `no_gate` with exit code 2. An unconfigured gat
 | `proofloop runner run --plan <file> --budget-usd 100` | Run an append-only, budgeted task plan under `.proofloop/runner/runs/<runId>/`. |
 | `proofloop runner resume --run-id latest` | Resume a runner after a crash; stale `running` tasks are requeued. |
 | `proofloop runner status --run-id latest [--json]` | Inspect durable runner state and ledger paths. |
+| `proofloop transfer-check sample --capability <file> --seed <sha>` | Deterministic stratified browser-lane sample from capability results (failures included by design). |
+| `proofloop transfer-check gate --capability <file> --browser <file>` | Two-layer agreement gate: exit 0 agreed / 1 diverged / 2 unusable (fail-closed). |
 | `proofloop mcp` | Start the optional read-only MCP server. |
 | `proofloop gate [--check]` | Run configured checks or `npm test`; exit 0 pass, 1 fail, 2 unusable. |
 | `proofloop hooks install\|uninstall\|status` | Install/remove/status Claude Code Stop, PreToolUse, and PostToolUse hooks. |
@@ -165,6 +167,51 @@ npx proofloop tooluse verify --contract tooluse-contract.json
 The verifier is fail-closed: a deny-list cannot be certified from an empty or missing log, and
 server-pinned names mean `mcp__evil__X` cannot impersonate `mcp__composio__X`.
 
+## Two-layer certification: the transfer gate
+
+Running every benchmark task through a real browser is slow and expensive, so the
+two-layer model (`two-layer-certification-v1`) splits certification:
+
+- the **capability lane** runs ALL tasks through the live agent harness (headless, cheap);
+- the **browser lane** replays a small stratified sample through the real production UI.
+
+The split saves ~95% of cost and wall-clock, but it opens a gaming surface: the harness
+lane could take shortcuts the product path does not have (memory-mode, bypassed tool
+contracts) and nothing would notice. `proofloop transfer-check` closes that hole by
+treating the browser sample as an **agreement test on the capability lane** -- the
+anti-cheat doctrine's in-app transfer rule made mechanical. Divergence fails closed.
+
+```bash
+# 1. Sample which capability results the browser lane must replay.
+#    Pass the commit SHA as the seed: same seed + same input = byte-identical sample,
+#    so the agent cannot re-roll the dice until it gets a sample it likes.
+npx proofloop transfer-check sample --capability capability-results.json --seed "$(git rev-parse HEAD)" > transfer-sample.json
+
+# 2. Run the sampled tasks through the real UI, record browser receipts, then gate.
+npx proofloop transfer-check gate --capability capability-results.json --browser browser-receipts.json
+```
+
+Both lanes accept either a receipts JSON array (`[{ taskId, model, family?, pass }]`)
+or a runner events ledger (`.proofloop/runner/runs/<runId>/ledger.jsonl`; label ledger
+rows with `--model`).
+
+**Why failures must be sampled.** Verifying capability-lane failures is as important as
+verifying passes: a failure that passes in the browser exposes a harness bug (the lane is
+under-reporting); a pass that fails in the browser exposes a harness shortcut (the claim
+is inflated). The sampler therefore reserves at least `ceil(N/3)` slots per family for
+failures whenever failures exist, and the gate refuses (exit 2, cherry-pick guard) a
+browser set that paired with zero capability failures -- overridable only by an explicit
+`--allow-no-failure-overlap`, which prints a loud warning into the output.
+
+**Claim language rule.** On agreement the gate prints exactly what was proven:
+capability verified through the harness, plus transfer verified on N seeded pairs --
+never "all tasks browser-verified". Exit codes: `0` agreement >= `--min-agreement`
+(default 0.9) with overlap >= `--min-overlap` (default 5); `1` divergence, with each
+disagreeing pair labeled by direction (capability-pass/browser-fail = suspected harness
+shortcut; capability-fail/browser-pass = suspected harness under-reporting); `2`
+unusable evidence (unreadable inputs, thin overlap, or cherry-picked sample). Zero
+evidence never exits 0.
+
 ## Scope
 
 This package is the portable core: gate, refuse-fake-done hooks, expected-tool-use contracts,
diff --git a/dist/cli.js b/dist/cli.js
index 787df72..6917e95 100644
--- a/dist/cli.js
+++ b/dist/cli.js
@@ -14,6 +14,7 @@ exports.runCli = runCli;
  *   proofloop ci install github        write the GitHub Actions gate workflow
  *   proofloop prompt                   print the one-prompt kickoff
  *   proofloop this-repo [--goal ...] [--write-runner-plan] [--run]
+ *   proofloop transfer-check sample|gate   two-layer certification agreement gate
  *   proofloop manifest|docs|template|workflow|ui|resume|report|charts|mcp
  *
  * Exit codes are per-command (documented at each case). Zero runtime deps.
@@ -30,6 +31,7 @@ const proofloopToolUse_1 = require("./proofloopToolUse");
 const mcp_1 = require("./mcp");
 const project_1 = require("./project");
 const runner_1 = require("./runner");
+const transferCheck_1 = require("./transferCheck");
 exports.MCP_SERVER_RUNNING = -999;
 /** Parse `--flag`, `--flag value`, `--flag=value`, and positionals. */
 function parseArgs(argv) {
@@ -92,6 +94,7 @@ function usage() {
         "  report latest [--json]     latest gate report",
         "  charts latest              write local JSON/SVG proof charts",
         "  runner run|resume|status   durable append-only task runner with budget and resume",
+        "  transfer-check sample|gate two-layer certification: seeded browser sample + agreement gate",
         "  mcp                        start the optional read-only MCP server",
         "  prompt                     print the one-prompt kickoff",
         "  this-repo [--goal <text>] [--write-runner-plan] [--run]",
@@ -157,6 +160,8 @@ function runCli(argv) {
             return runChartsCommand(positional[1], root);
         case "runner":
             return runRunnerCommand(positional[1], options, root);
+        case "transfer-check":
+            return (0, transferCheck_1.runTransferCheckCommand)(positional[1], options, root);
         case "mcp":
             (0, mcp_1.startMcpServer)({ root });
             return exports.MCP_SERVER_RUNNING;
diff --git a/dist/index.d.ts b/dist/index.d.ts
index a790b11..e07fe40 100644
--- a/dist/index.d.ts
+++ b/dist/index.d.ts
@@ -18,4 +18,5 @@ export * from "./project";
 export * from "./mcp";
 export * from "./runner";
 export * from "./layeredPlan";
+export * from "./transferCheck";
 export { runCli } from "./cli";
diff --git a/dist/index.js b/dist/index.js
index c2e5150..9ec5f00 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -35,5 +35,6 @@ __exportStar(require("./project"), exports);
 __exportStar(require("./mcp"), exports);
 __exportStar(require("./runner"), exports);
 __exportStar(require("./layeredPlan"), exports);
+__exportStar(require("./transferCheck"), exports);
 var cli_1 = require("./cli");
 Object.defineProperty(exports, "runCli", { enumerable: true, get: function () { return cli_1.runCli; } });
diff --git a/dist/prompt.d.ts b/dist/prompt.d.ts
index 2245032..fdf655e 100644
--- a/dist/prompt.d.ts
+++ b/dist/prompt.d.ts
@@ -6,5 +6,5 @@
  * mentioned here is a real command.
  */
 /** The set of top-level commands the package CLI implements. */
-export declare const PACKAGE_COMMANDS: readonly ["init", "doctor", "gate", "hooks", "tooluse", "ci", "manifest", "docs", "template", "workflow", "ui", "resume", "report", "charts", "runner", "mcp", "prompt", "this-repo"];
+export declare const PACKAGE_COMMANDS: readonly ["init", "doctor", "gate", "hooks", "tooluse", "ci", "manifest", "docs", "template", "workflow", "ui", "resume", "report", "charts", "runner", "transfer-check", "mcp", "prompt", "this-repo"];
 export declare function proofloopKickoffPrompt(): string;
diff --git a/dist/prompt.js b/dist/prompt.js
index ed15b29..2ad975b 100644
--- a/dist/prompt.js
+++ b/dist/prompt.js
@@ -26,6 +26,7 @@ exports.PACKAGE_COMMANDS = [
     "report",
     "charts",
     "runner",
+    "transfer-check",
     "mcp",
     "prompt",
     "this-repo",
diff --git a/dist/transferCheck.d.ts b/dist/transferCheck.d.ts
new file mode 100644
index 0000000..40dbe6c
--- /dev/null
+++ b/dist/transferCheck.d.ts
@@ -0,0 +1,87 @@
+export declare const TRANSFER_SAMPLE_SCHEMA = "proofloop-transfer-sample-v1";
+export type TransferLaneResult = {
+    taskId: string;
+    model: string;
+    family: string;
+    pass: boolean;
+};
+export type TransferLaneRead = {
+    results: TransferLaneResult[];
+    warnings: string[];
+    source: "receipts" | "runner-ledger";
+};
+export type TransferSamplePair = {
+    taskId: string;
+    model: string;
+    family: string;
+    capabilityPass: boolean;
+};
+export type TransferSamplePlan = {
+    schema: typeof TRANSFER_SAMPLE_SCHEMA;
+    seed: string;
+    pairs: TransferSamplePair[];
+};
+export type TransferDisagreementDirection = "capability-pass-browser-fail" | "capability-fail-browser-pass";
+export declare const TRANSFER_DIRECTION_LABELS: Record<TransferDisagreementDirection, string>;
+export type TransferDisagreement = {
+    taskId: string;
+    model: string;
+    family: string;
+    capabilityPass: boolean;
+    browserPass: boolean;
+    direction: TransferDisagreementDirection;
+    label: string;
+};
+export type TransferGateEvaluation = {
+    status: "agreed" | "diverged" | "unusable";
+    /** Present when status === "unusable". */
+    reason?: string;
+    overlap: number;
+    matches: number;
+    agreementRatio: number;
+    minAgreement: number;
+    minOverlap: number;
+    capabilityFailuresTotal: number;
+    pairedCapabilityFailures: number;
+    disagreements: TransferDisagreement[];
+    warnings: string[];
+};
+export declare function readTransferLaneResults(path: string, options?: {
+    ledgerModel?: string;
+}): TransferLaneRead;
+/**
+ * Deterministic stratified sample of the capability lane for browser
+ * certification. Same seed + same input = byte-identical plan (the per-family
+ * PRNG stream is `fnv1a(seed|family)`, so adding a family never changes
+ * another family's picks). If a family has capability failures, at least
+ * ceil(perFamily/3) of its sample slots are failures (capped by how many
+ * failures exist): failures must transfer too, or the failure path of the
+ * harness is never checked against the product.
+ */
+export declare function buildTransferSample(capability: readonly TransferLaneResult[], options: {
+    seed: string;
+    perFamily?: number;
+}): TransferSamplePlan;
+export declare function evaluateTransferGate(capability: readonly TransferLaneResult[], browser: readonly TransferLaneResult[], options?: {
+    minAgreement?: number;
+    minOverlap?: number;
+    allowNoFailureOverlap?: boolean;
+}): TransferGateEvaluation;
+/**
+ * The doctrine claim line printed on exit 0 -- deliberately scoped language.
+ * The browser lane certified a stratified sample, so the only honest claim is
+ * "capability lane verified + transfer verified on N seeded pairs", never
+ * "all tasks browser-verified".
+ */
+export declare function transferClaimLine(evaluation: TransferGateEvaluation): string;
+type TransferCheckIo = {
+    log?: (line: string) => void;
+    logError?: (line: string) => void;
+};
+/**
+ * `proofloop transfer-check sample|gate`. Exit codes:
+ *   sample: 0 wrote/printed the plan, 2 unusable input or bad flags.
+ *   gate:   0 agreed, 1 diverged, 2 unusable (fail-closed).
+ */
+export declare function runTransferCheckCommand(sub: string | undefined, options: Record<string, string | boolean>, root: string, io?: TransferCheckIo): number;
+export {};
diff --git a/dist/transferCheck.js b/dist/transferCheck.js
new file mode 100644
index 0000000..9a88a5b
--- /dev/null
+++ b/dist/transferCheck.js
@@ -0,0 +1,485 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSFER_DIRECTION_LABELS = exports.TRANSFER_SAMPLE_SCHEMA = void 0;
+exports.readTransferLaneResults = readTransferLaneResults;
+exports.buildTransferSample = buildTransferSample;
+exports.evaluateTransferGate = evaluateTransferGate;
+exports.transferClaimLine = transferClaimLine;
+exports.runTransferCheckCommand = runTransferCheckCommand;
+/**
+ * `proofloop transfer-check` -- the two-layer certification AGREEMENT GATE.
+ *
+ * WHY THIS EXISTS: Proof Loop is adopting a two-layer certification model
+ * ("two-layer-certification-v1", the vocabulary shared with layeredPlan.ts):
+ *
+ *   - a headless CAPABILITY lane runs ALL benchmark tasks through the live
+ *     agent harness (cheap, no browser);
+ *   - a BROWSER lane runs a small stratified sample through the real
+ *     production UI.
+ *
+ * The split saves ~95% of cost and wall-clock, BUT it creates a new gaming
+ * surface: the harness lane could take shortcuts the product path does not
+ * have (memory-mode, bypassed tool contracts) and nothing would notice.
+ * transfer-check makes the anti-cheat doctrine's IN-APP TRANSFER rule
+ * mechanical: browser samples are an agreement test ON the capability lane,
+ * and divergence fails closed.
+ *
+ * Direction matters, so disagreements are labeled distinctly:
+ *   - capability-pass / browser-fail => suspected harness shortcut or
+ *     product-path break -- the capability claim is suspect.
+ *   - capability-fail / browser-pass => suspected harness bug or env gap --
+ *     the capability lane is under-reporting.
+ *
+ * Verifying failures is as important as verifying passes: a failure that
+ * passes in the browser exposes a harness bug; a pass that fails in the
+ * browser exposes a harness shortcut. The sampler therefore MUST include
+ * capability-lane failures, and the gate refuses (exit 2, cherry-pick guard)
+ * a browser set that dodged every capability failure.
+ *
+ * Subcommands:
+ *   proofloop transfer-check sample --capability <file> --seed <string>
+ *       [--per-family 5] [--model <label>] [--out <file>]
+ *     Deterministic stratified sampler. The seed is REQUIRED and callers
+ *     should pass a commit SHA so the agent cannot re-roll or cherry-pick
+ *     the sample. Same seed + same input = byte-identical sample plan.
+ *
+ *   proofloop transfer-check gate --capability <file> --browser <file>
+ *       [--min-agreement 0.9] [--min-overlap 5] [--model <label>]
+ *       [--allow-no-failure-overlap]
+ *     Joins the two lanes on taskId+model and computes agreement over the
+ *     paired set. Exit 0 = agreed (prints the doctrine claim line, which is
+ *     deliberately NOT an "all tasks browser-verified" claim); exit 1 =
+ *     diverged (per-pair direction-labeled table); exit 2 = unusable
+ *     (unreadable inputs, overlap below minimum, or cherry-pick guard).
+ *     Never exits 0 on zero evidence.
+ *
+ * Accepted lane inputs (auto-detected, fail-closed):
+ *   - a receipts JSON array: [{ taskId, model, family?, pass }]
+ *     (unknown keys warn; missing required fields reject; duplicate
+ *     taskId+model pairs reject);
+ *   - a runner events ledger (runner.ts appends
+ *     .proofloop/runner/runs/<runId>/ledger.jsonl): per-task verdicts are
+ *     derived from `task_completed` events' data.status ("passed"/"failed").
+ *     Retried tasks are legitimate under resume, so the LAST completed
+ *     verdict per taskId wins. Ledger events carry no model, so the caller
+ *     labels ledger-derived rows via --model; family is derived from the
+ *     layered-plan task-id prefix ("capability.test" -> "capability").
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.TRANSFER_SAMPLE_SCHEMA = "proofloop-transfer-sample-v1";
+exports.TRANSFER_DIRECTION_LABELS = {
+    "capability-pass-browser-fail": "suspected harness shortcut or product-path break -- capability claim suspect",
+    "capability-fail-browser-pass": "suspected harness bug or env gap -- capability lane under-reporting",
+};
+const RECEIPT_KNOWN_KEYS = ["taskId", "model", "family", "pass"];
+const RUNNER_EVENT_SCHEMA = "proofloop-runner-event-v1";
+const DEFAULT_PER_FAMILY = 5;
+const DEFAULT_MIN_AGREEMENT = 0.9;
+const DEFAULT_MIN_OVERLAP = 5;
+/** Guard against float noise at exactly-threshold agreement (e.g. 9/10 vs 0.9). */
+const AGREEMENT_EPSILON = 1e-12;
+// ---------------------------------------------------------------------------
+// lane readers (fail-closed: any surprise throws; the CLI maps throws to exit 2)
+// ---------------------------------------------------------------------------
+function readTransferLaneResults(path, options = {}) {
+    if (!(0, node_fs_1.existsSync)(path))
+        throw new Error(`lane input not found: ${path}`);
+    const raw = (0, node_fs_1.readFileSync)(path, "utf8").replace(/^\uFEFF/, "");
+    if (raw.trimStart().startsWith("["))
+        return readReceiptsArray(raw, path);
+    return readRunnerLedger(raw, path, options.ledgerModel);
+}
+function readReceiptsArray(raw, path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`receipts file ${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!Array.isArray(parsed))
+        throw new Error(`receipts file ${path} must be a JSON array of { taskId, model, family?, pass }`);
+    if (parsed.length === 0)
+        throw new Error(`receipts file ${path} is an empty array -- zero evidence is unusable (fail-closed)`);
+    const warnings = [];
+    const seen = new Set();
+    const results = parsed.map((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            throw new Error(`receipts entry ${index} in ${path} must be an object { taskId, model, family?, pass }`);
+        }
+        const record = entry;
+        for (const key of Object.keys(record)) {
+            if (!RECEIPT_KNOWN_KEYS.includes(key)) {
+                warnings.push(`receipts entry ${index} in ${path} has unknown key "${key}" (ignored; known keys: ${RECEIPT_KNOWN_KEYS.join(", ")})`);
+            }
+        }
+        const taskId = record.taskId;
+        if (typeof taskId !== "string" || !taskId.trim())
+            throw new Error(`receipts entry ${index} in ${path}: "taskId" (non-empty string) is required`);
+        const model = record.model;
+        if (typeof model !== "string" || !model.trim())
+            throw new Error(`receipts entry ${index} in ${path}: "model" (non-empty string) is required`);
+        const pass = record.pass;
+        if (typeof pass !== "boolean")
+            throw new Error(`receipts entry ${index} in ${path}: "pass" (boolean) is required -- refusing to coerce ${JSON.stringify(pass)}`);
+        let family = "default";
+        if (record.family !== undefined) {
+            if (typeof record.family !== "string" || !record.family.trim()) {
+                throw new Error(`receipts entry ${index} in ${path}: "family" must be a non-empty string when present`);
+            }
+            family = record.family;
+        }
+        const pairKey = joinKey(taskId, model);
+        if (seen.has(pairKey)) {
+            throw new Error(`duplicate taskId+model pair in ${path}: "${taskId}" + "${model}" -- refusing to guess which verdict is real (fail-closed)`);
+        }
+        seen.add(pairKey);
+        return { taskId, model, family, pass };
+    });
+    return { results, warnings, source: "receipts" };
+}
+function readRunnerLedger(raw, path, ledgerModel) {
+    const warnings = [];
+    const model = ledgerModel ?? "unspecified";
+    if (!ledgerModel) {
+        warnings.push(`runner ledger ${path}: no --model label given; ledger rows get model "unspecified" (pass --model <label> so gate joins line up)`);
+    }
+    const lines = raw.split(/\r?\n/);
+    const verdicts = new Map();
+    let sawLedgerEvent = false;
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index];
+        if (!line.trim())
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new Error(`${path}:${index + 1}: not a receipts JSON array and not a parseable runner-ledger line -- accepted inputs are a receipts array [{taskId,model,family?,pass}] or a ${RUNNER_EVENT_SCHEMA} events ledger (fail-closed)`);
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`${path}:${index + 1}: ledger line must be a JSON object (fail-closed)`);
+        }
+        const event = parsed;
+        if (event.schema !== RUNNER_EVENT_SCHEMA) {
+            throw new Error(`${path}:${index + 1}: expected schema "${RUNNER_EVENT_SCHEMA}", got ${JSON.stringify(event.schema)} (fail-closed)`);
+        }
+        sawLedgerEvent = true;
+        if (event.event !== "task_completed")
+            continue;
+        const taskId = event.taskId;
+        if (typeof taskId !== "string" || !taskId.trim()) {
+            throw new Error(`${path}:${index + 1}: task_completed event has no usable taskId (fail-closed; runner schema drift?)`);
+        }
+        const data = event.data;
+        const status = data && typeof data === "object" && !Array.isArray(data) ? data.status : undefined;
+        if (status !== "passed" && status !== "failed") {
+            throw new Error(`${path}:${index + 1}: task_completed data.status must be "passed" or "failed", got ${JSON.stringify(status)} (fail-closed; runner schema drift?)`);
+        }
+        // Retries after crash/resume are legitimate runner behavior: last verdict wins.
+        verdicts.set(taskId, { taskId, model, family: familyFromTaskId(taskId), pass: status === "passed" });
+    }
+    if (!sawLedgerEvent) {
+        throw new Error(`${path}: no ${RUNNER_EVENT_SCHEMA} lines found -- accepted inputs are a receipts JSON array or a runner events ledger (fail-closed)`);
+    }
+    if (verdicts.size === 0) {
+        throw new Error(`${path}: ledger contains no task_completed verdicts -- zero evidence is unusable (fail-closed)`);
+    }
+    return { results: [...verdicts.values()], warnings, source: "runner-ledger" };
+}
+/** Layered-plan task ids are "<lane>.<name>" (see layeredPlan.ts); the prefix is the natural family. */
+function familyFromTaskId(taskId) {
+    const dot = taskId.indexOf(".");
+    return dot > 0 ? taskId.slice(0, dot) : "default";
+}
+function joinKey(taskId, model) {
+    return `${taskId}${model}`;
+}
+// ---------------------------------------------------------------------------
+// deterministic stratified sampler
+// ---------------------------------------------------------------------------
+/** FNV-1a 32-bit over the seed string; feeds the xorshift32 stream. */
+function fnv1a32(text) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return hash >>> 0;
+}
+function seededRandom(seedText) {
+    let state = fnv1a32(seedText) || 0x9e3779b9; // xorshift must not start at 0
+    return () => {
+        state ^= state << 13;
+        state >>>= 0;
+        state ^= state >>> 17;
+        state ^= state << 5;
+        state >>>= 0;
+        return state / 0x1_0000_0000;
+    };
+}
+function shuffled(items, rand) {
+    const arr = items.slice();
+    for (let i = arr.length - 1; i > 0; i--) {
+        const j = Math.floor(rand() * (i + 1));
+        const tmp = arr[i];
+        arr[i] = arr[j];
+        arr[j] = tmp;
+    }
+    return arr;
+}
+function byFamilyTaskModel(a, b) {
+    return a.family.localeCompare(b.family) || a.taskId.localeCompare(b.taskId) || a.model.localeCompare(b.model);
+}
+/**
+ * Deterministic stratified sample of the capability lane for browser
+ * certification. Same seed + same input = byte-identical plan (the per-family
+ * PRNG stream is `fnv1a(seed|family)`, so adding a family never changes
+ * another family's picks). If a family has capability failures, at least
+ * ceil(perFamily/3) of its sample slots are failures (capped by how many
+ * failures exist): failures must transfer too, or the failure path of the
+ * harness is never checked against the product.
+ */
+function buildTransferSample(capability, options) {
+    const seed = options.seed;
+    if (typeof seed !== "string" || !seed.trim()) {
+        throw new Error("sample requires --seed <string>; pass a commit SHA so the sample cannot be re-rolled or cherry-picked");
+    }
+    const perFamily = options.perFamily ?? DEFAULT_PER_FAMILY;
+    if (!Number.isInteger(perFamily) || perFamily < 1)
+        throw new Error("--per-family must be an integer >= 1");
+    if (capability.length === 0)
+        throw new Error("capability set is empty -- nothing to sample (fail-closed)");
+    const byFamily = new Map();
+    for (const result of capability) {
+        const list = byFamily.get(result.family) ?? [];
+        list.push(result);
+        byFamily.set(result.family, list);
+    }
+    const pairs = [];
+    for (const family of [...byFamily.keys()].sort()) {
+        const members = [...(byFamily.get(family) ?? [])].sort(byFamilyTaskModel);
+        const rand = seededRandom(`${seed}|${family}`);
+        const failures = members.filter((member) => !member.pass);
+        const slots = Math.min(perFamily, members.length);
+        const failureSlots = failures.length === 0 ? 0 : Math.min(Math.ceil(perFamily / 3), failures.length, slots);
+        const picked = new Set();
+        for (const failure of shuffled(failures, rand).slice(0, failureSlots))
+            picked.add(failure);
+        const rest = members.filter((member) => !picked.has(member));
+        for (const member of shuffled(rest, rand).slice(0, slots - picked.size))
+            picked.add(member);
+        for (const member of [...picked].sort(byFamilyTaskModel)) {
+            pairs.push({ taskId: member.taskId, model: member.model, family: member.family, capabilityPass: member.pass });
+        }
+    }
+    pairs.sort(byFamilyTaskModel);
+    return { schema: exports.TRANSFER_SAMPLE_SCHEMA, seed, pairs };
+}
+// ---------------------------------------------------------------------------
+// agreement gate
+// ---------------------------------------------------------------------------
+function evaluateTransferGate(capability, browser, options = {}) {
+    const minAgreement = options.minAgreement ?? DEFAULT_MIN_AGREEMENT;
+    if (!Number.isFinite(minAgreement) || minAgreement < 0 || minAgreement > 1) {
+        throw new Error("--min-agreement must be a number between 0 and 1");
+    }
+    const requestedMinOverlap = options.minOverlap ?? DEFAULT_MIN_OVERLAP;
+    if (!Number.isInteger(requestedMinOverlap))
+        throw new Error("--min-overlap must be an integer");
+    // Never certify zero evidence, no matter what the caller asked for.
+    const minOverlap = Math.max(1, requestedMinOverlap);
+    const capabilityByKey = new Map();
+    for (const result of capability)
+        capabilityByKey.set(joinKey(result.taskId, result.model), result);
+    const paired = [];
+    for (const browserResult of [...browser].sort(byFamilyTaskModel)) {
+        const cap = capabilityByKey.get(joinKey(browserResult.taskId, browserResult.model));
+        if (cap)
+            paired.push({ cap, browser: browserResult });
+    }
+    const overlap = paired.length;
+    const capabilityFailuresTotal = capability.filter((result) => !result.pass).length;
+    const pairedCapabilityFailures = paired.filter((pair) => !pair.cap.pass).length;
+    const matches = paired.filter((pair) => pair.cap.pass === pair.browser.pass).length;
+    const agreementRatio = overlap === 0 ? 0 : matches / overlap;
+    const disagreements = paired
+        .filter((pair) => pair.cap.pass !== pair.browser.pass)
+        .map((pair) => {
+        const direction = pair.cap.pass ? "capability-pass-browser-fail" : "capability-fail-browser-pass";
+        return {
+            taskId: pair.cap.taskId,
+            model: pair.cap.model,
+            family: pair.cap.family,
+            capabilityPass: pair.cap.pass,
+            browserPass: pair.browser.pass,
+            direction,
+            label: exports.TRANSFER_DIRECTION_LABELS[direction],
+        };
+    });
+    const base = {
+        overlap,
+        matches,
+        agreementRatio,
+        minAgreement,
+        minOverlap,
+        capabilityFailuresTotal,
+        pairedCapabilityFailures,
+        disagreements,
+        warnings: [],
+    };
+    if (overlap < minOverlap) {
+        return {
+            status: "unusable",
+            reason: overlap === 0
+                ? "zero paired taskId+model verdicts between the capability and browser lanes -- zero evidence can never certify agreement"
+                : `paired overlap ${overlap} is below --min-overlap ${minOverlap} -- too little evidence to certify agreement`,
+            ...base,
+        };
+    }
+    if (capabilityFailuresTotal > 0 && pairedCapabilityFailures === 0) {
+        if (!options.allowNoFailureOverlap) {
+            return {
+                status: "unusable",
+                reason: `cherry-pick guard: the capability set contains ${capabilityFailuresTotal} failure(s) but the browser paired set contains ZERO of them; ` +
+                    "a sample that dodges every failure cannot certify the failure path (pass --allow-no-failure-overlap to override with a loud warning)",
+                ...base,
+            };
+        }
+        base.warnings.push(`WARNING: --allow-no-failure-overlap: the capability set contains ${capabilityFailuresTotal} failure(s) but the browser paired set includes NONE of them. ` +
+            "Harness shortcuts on the failure path remain UNVERIFIED; this agreement claim is weaker than the standard transfer gate.");
+    }
+    return {
+        status: agreementRatio >= minAgreement - AGREEMENT_EPSILON ? "agreed" : "diverged",
+        ...base,
+    };
+}
+/**
+ * The doctrine claim line printed on exit 0 -- deliberately scoped language.
+ * The browser lane certified a stratified sample, so the only honest claim is
+ * "capability lane verified + transfer verified on N seeded pairs", never
+ * "all tasks browser-verified".
+ */
+function transferClaimLine(evaluation) {
+    return (`Capability verified through the live agent harness; production browser path verified by stratified UI certification ` +
+        `(agreement ${formatPercent(evaluation.agreementRatio)}% on ${evaluation.overlap} seeded pairs including ` +
+        `${evaluation.pairedCapabilityFailures} capability-failures). This is NOT an all-tasks-browser-verified claim.`);
+}
+function formatPercent(ratio) {
+    const rounded = Math.round(ratio * 1000) / 10;
+    return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+}
+function strOption(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function intOption(value, flag) {
+    const raw = strOption(value);
+    if (raw === undefined) {
+        if (value === true)
+            throw new Error(`${flag} requires a value`);
+        return undefined;
+    }
+    const parsed = Number(raw);
+    if (!Number.isInteger(parsed))
+        throw new Error(`${flag} must be an integer, got ${JSON.stringify(raw)}`);
+    return parsed;
+}
+function floatOption(value, flag) {
+    const raw = strOption(value);
+    if (raw === undefined) {
+        if (value === true)
+            throw new Error(`${flag} requires a value`);
+        return undefined;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        throw new Error(`${flag} must be a number, got ${JSON.stringify(raw)}`);
+    return parsed;
+}
+function resolveLane(root, path) {
+    return (0, node_path_1.isAbsolute)(path) ? path : (0, node_path_1.resolve)(root, path);
+}
+/**
+ * `proofloop transfer-check sample|gate`. Exit codes:
+ *   sample: 0 wrote/printed the plan, 2 unusable input or bad flags.
+ *   gate:   0 agreed, 1 diverged, 2 unusable (fail-closed).
+ */
+function runTransferCheckCommand(sub, options, root, io = {}) {
+    const log = io.log ?? console.log;
+    const logError = io.logError ?? console.error;
+    try {
+        if (sub === "sample")
+            return runSample(options, root, log, logError);
+        if (sub === "gate")
+            return runGateSub(options, root, log, logError);
+        logError("proofloop transfer-check: expected `sample` or `gate`.");
+        return 2;
+    }
+    catch (error) {
+        logError(`proofloop transfer-check: ${error instanceof Error ? error.message : String(error)} (fail-closed, exit 2)`);
+        return 2;
+    }
+}
+function runSample(options, root, log, logError) {
+    const capabilityPath = strOption(options.capability);
+    if (!capabilityPath)
+        throw new Error("sample requires --capability <file>");
+    const seed = strOption(options.seed);
+    if (!seed)
+        throw new Error("sample requires --seed <string>; pass a commit SHA so the sample cannot be re-rolled or cherry-picked");
+    const perFamily = intOption(options["per-family"], "--per-family");
+    const lane = readTransferLaneResults(resolveLane(root, capabilityPath), { ...(strOption(options.model) !== undefined ? { ledgerModel: strOption(options.model) } : {}) });
+    for (const warning of lane.warnings)
+        logError(`proofloop transfer-check: warning: ${warning}`);
+    const plan = buildTransferSample(lane.results, { seed, ...(perFamily !== undefined ? { perFamily } : {}) });
+    const serialized = JSON.stringify(plan, null, 2);
+    const outPath = strOption(options.out);
+    if (outPath) {
+        const resolved = resolveLane(root, outPath);
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(resolved), { recursive: true });
+        (0, node_fs_1.writeFileSync)(resolved, `${serialized}\n`, "utf8");
+        logError(`proofloop transfer-check: wrote sample plan to ${resolved}`);
+    }
+    log(serialized);
+    return 0;
+}
+function runGateSub(options, root, log, logError) {
+    const capabilityPath = strOption(options.capability);
+    const browserPath = strOption(options.browser);
+    if (!capabilityPath || !browserPath)
+        throw new Error("gate requires --capability <file> and --browser <file>");
+    const minAgreement = floatOption(options["min-agreement"], "--min-agreement");
+    const minOverlap = intOption(options["min-overlap"], "--min-overlap");
+    const ledgerModel = strOption(options.model);
+    const capability = readTransferLaneResults(resolveLane(root, capabilityPath), { ...(ledgerModel !== undefined ? { ledgerModel } : {}) });
+    const browser = readTransferLaneResults(resolveLane(root, browserPath), { ...(ledgerModel !== undefined ? { ledgerModel } : {}) });
+    for (const warning of [...capability.warnings, ...browser.warnings])
+        logError(`proofloop transfer-check: warning: ${warning}`);
+    const evaluation = evaluateTransferGate(capability.results, browser.results, {
+        ...(minAgreement !== undefined ? { minAgreement } : {}),
+        ...(minOverlap !== undefined ? { minOverlap } : {}),
+        allowNoFailureOverlap: options["allow-no-failure-overlap"] === true,
+    });
+    if (evaluation.status === "unusable") {
+        logError(`proofloop transfer-check: UNUSABLE -- ${evaluation.reason} (fail-closed, exit 2)`);
+        return 2;
+    }
+    for (const warning of evaluation.warnings)
+        log(`proofloop transfer-check: ${warning}`);
+    if (evaluation.status === "diverged") {
+        log(`proofloop transfer-check: DIVERGED -- agreement ${formatPercent(evaluation.agreementRatio)}% < required ` +
+            `${formatPercent(evaluation.minAgreement)}% on ${evaluation.overlap} paired verdicts.`);
+        log("  disagreements:");
+        for (const disagreement of evaluation.disagreements) {
+            log(`    - ${disagreement.taskId} [${disagreement.model} / ${disagreement.family}] ` +
+                `capability=${disagreement.capabilityPass ? "pass" : "fail"} browser=${disagreement.browserPass ? "pass" : "fail"} -> ${disagreement.label}`);
+        }
+        log("  Do not publish the capability-lane score until each divergence is root-caused.");
+        return 1;
+    }
+    log(`proofloop transfer-check: AGREED -- ${evaluation.matches}/${evaluation.overlap} paired verdicts match.`);
+    log(transferClaimLine(evaluation));
+    return 0;
+}
diff --git a/src/cli.ts b/src/cli.ts
index a5447cc..0a68546 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -10,6 +10,7 @@
  *   proofloop ci install github        write the GitHub Actions gate workflow
  *   proofloop prompt                   print the one-prompt kickoff
  *   proofloop this-repo [--goal ...] [--write-runner-plan] [--run]
+ *   proofloop transfer-check sample|gate   two-layer certification agreement gate
  *   proofloop manifest|docs|template|workflow|ui|resume|report|charts|mcp
  *
  * Exit codes are per-command (documented at each case). Zero runtime deps.
@@ -44,6 +45,7 @@ import {
   type ProofloopAgentTarget,
 } from "./project";
 import { runProofloopRunner } from "./runner";
+import { runTransferCheckCommand } from "./transferCheck";
 
 type Flags = { positional: string[]; options: Record<string, string | boolean> };
 export const MCP_SERVER_RUNNING = -999;
@@ -108,6 +110,7 @@ function usage(): string {
     "  report latest [--json]     latest gate report",
     "  charts latest              write local JSON/SVG proof charts",
     "  runner run|resume|status   durable append-only task runner with budget and resume",
+    "  transfer-check sample|gate two-layer certification: seeded browser sample + agreement gate",
     "  mcp                        start the optional read-only MCP server",
     "  prompt                     print the one-prompt kickoff",
     "  this-repo [--goal <text>] [--write-runner-plan] [--run]",
@@ -190,6 +193,9 @@ export function runCli(argv: string[]): number | Promise<number> {
     case "runner":
       return runRunnerCommand(positional[1], options, root);
 
+    case "transfer-check":
+      return runTransferCheckCommand(positional[1], options, root);
+
     case "mcp":
       startMcpServer({ root });
       return MCP_SERVER_RUNNING;
diff --git a/src/index.ts b/src/index.ts
index a790b11..e07fe40 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -18,4 +18,5 @@ export * from "./project";
 export * from "./mcp";
 export * from "./runner";
 export * from "./layeredPlan";
+export * from "./transferCheck";
 export { runCli } from "./cli";
diff --git a/src/prompt.ts b/src/prompt.ts
index 56d0320..b6bef6d 100644
--- a/src/prompt.ts
+++ b/src/prompt.ts
@@ -23,6 +23,7 @@ export const PACKAGE_COMMANDS = [
   "report",
   "charts",
   "runner",
+  "transfer-check",
   "mcp",
   "prompt",
   "this-repo",
diff --git a/src/transferCheck.ts b/src/transferCheck.ts
new file mode 100644
index 0000000..13a7755
--- /dev/null
+++ b/src/transferCheck.ts
@@ -0,0 +1,577 @@
+/**
+ * `proofloop transfer-check` -- the two-layer certification AGREEMENT GATE.
+ *
+ * WHY THIS EXISTS: Proof Loop is adopting a two-layer certification model
+ * ("two-layer-certification-v1", the vocabulary shared with layeredPlan.ts):
+ *
+ *   - a headless CAPABILITY lane runs ALL benchmark tasks through the live
+ *     agent harness (cheap, no browser);
+ *   - a BROWSER lane runs a small stratified sample through the real
+ *     production UI.
+ *
+ * The split saves ~95% of cost and wall-clock, BUT it creates a new gaming
+ * surface: the harness lane could take shortcuts the product path does not
+ * have (memory-mode, bypassed tool contracts) and nothing would notice.
+ * transfer-check makes the anti-cheat doctrine's IN-APP TRANSFER rule
+ * mechanical: browser samples are an agreement test ON the capability lane,
+ * and divergence fails closed.
+ *
+ * Direction matters, so disagreements are labeled distinctly:
+ *   - capability-pass / browser-fail => suspected harness shortcut or
+ *     product-path break -- the capability claim is suspect.
+ *   - capability-fail / browser-pass => suspected harness bug or env gap --
+ *     the capability lane is under-reporting.
+ *
+ * Verifying failures is as important as verifying passes: a failure that
+ * passes in the browser exposes a harness bug; a pass that fails in the
+ * browser exposes a harness shortcut. The sampler therefore MUST include
+ * capability-lane failures, and the gate refuses (exit 2, cherry-pick guard)
+ * a browser set that dodged every capability failure.
+ *
+ * Subcommands:
+ *   proofloop transfer-check sample --capability <file> --seed <string>
+ *       [--per-family 5] [--model <label>] [--out <file>]
+ *     Deterministic stratified sampler. The seed is REQUIRED and callers
+ *     should pass a commit SHA so the agent cannot re-roll or cherry-pick
+ *     the sample. Same seed + same input = byte-identical sample plan.
+ *
+ *   proofloop transfer-check gate --capability <file> --browser <file>
+ *       [--min-agreement 0.9] [--min-overlap 5] [--model <label>]
+ *       [--allow-no-failure-overlap]
+ *     Joins the two lanes on taskId+model and computes agreement over the
+ *     paired set. Exit 0 = agreed (prints the doctrine claim line, which is
+ *     deliberately NOT an "all tasks browser-verified" claim); exit 1 =
+ *     diverged (per-pair direction-labeled table); exit 2 = unusable
+ *     (unreadable inputs, overlap below minimum, or cherry-pick guard).
+ *     Never exits 0 on zero evidence.
+ *
+ * Accepted lane inputs (auto-detected, fail-closed):
+ *   - a receipts JSON array: [{ taskId, model, family?, pass }]
+ *     (unknown keys warn; missing required fields reject; duplicate
+ *     taskId+model pairs reject);
+ *   - a runner events ledger (runner.ts appends
+ *     .proofloop/runner/runs/<runId>/ledger.jsonl): per-task verdicts are
+ *     derived from `task_completed` events' data.status ("passed"/"failed").
+ *     Retried tasks are legitimate under resume, so the LAST completed
+ *     verdict per taskId wins. Ledger events carry no model, so the caller
+ *     labels ledger-derived rows via --model; family is derived from the
+ *     layered-plan task-id prefix ("capability.test" -> "capability").
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, resolve } from "node:path";
+
+export const TRANSFER_SAMPLE_SCHEMA = "proofloop-transfer-sample-v1";
+
+export type TransferLaneResult = {
+  taskId: string;
+  model: string;
+  family: string;
+  pass: boolean;
+};
+
+export type TransferLaneRead = {
+  results: TransferLaneResult[];
+  warnings: string[];
+  source: "receipts" | "runner-ledger";
+};
+
+export type TransferSamplePair = {
+  taskId: string;
+  model: string;
+  family: string;
+  capabilityPass: boolean;
+};
+
+export type TransferSamplePlan = {
+  schema: typeof TRANSFER_SAMPLE_SCHEMA;
+  seed: string;
+  pairs: TransferSamplePair[];
+};
+
+export type TransferDisagreementDirection = "capability-pass-browser-fail" | "capability-fail-browser-pass";
+
+export const TRANSFER_DIRECTION_LABELS: Record<TransferDisagreementDirection, string> = {
+  "capability-pass-browser-fail": "suspected harness shortcut or product-path break -- capability claim suspect",
+  "capability-fail-browser-pass": "suspected harness bug or env gap -- capability lane under-reporting",
+};
+
+export type TransferDisagreement = {
+  taskId: string;
+  model: string;
+  family: string;
+  capabilityPass: boolean;
+  browserPass: boolean;
+  direction: TransferDisagreementDirection;
+  label: string;
+};
+
+export type TransferGateEvaluation = {
+  status: "agreed" | "diverged" | "unusable";
+  /** Present when status === "unusable". */
+  reason?: string;
+  overlap: number;
+  matches: number;
+  agreementRatio: number;
+  minAgreement: number;
+  minOverlap: number;
+  capabilityFailuresTotal: number;
+  pairedCapabilityFailures: number;
+  disagreements: TransferDisagreement[];
+  warnings: string[];
+};
+
+const RECEIPT_KNOWN_KEYS: readonly string[] = ["taskId", "model", "family", "pass"];
+const RUNNER_EVENT_SCHEMA = "proofloop-runner-event-v1";
+const DEFAULT_PER_FAMILY = 5;
+const DEFAULT_MIN_AGREEMENT = 0.9;
+const DEFAULT_MIN_OVERLAP = 5;
+/** Guard against float noise at exactly-threshold agreement (e.g. 9/10 vs 0.9). */
+const AGREEMENT_EPSILON = 1e-12;
+
+// ---------------------------------------------------------------------------
+// lane readers (fail-closed: any surprise throws; the CLI maps throws to exit 2)
+// ---------------------------------------------------------------------------
+
+export function readTransferLaneResults(path: string, options: { ledgerModel?: string } = {}): TransferLaneRead {
+  if (!existsSync(path)) throw new Error(`lane input not found: ${path}`);
+  const raw = readFileSync(path, "utf8").replace(/^\uFEFF/, "");
+  if (raw.trimStart().startsWith("[")) return readReceiptsArray(raw, path);
+  return readRunnerLedger(raw, path, options.ledgerModel);
+}
+
+function readReceiptsArray(raw: string, path: string): TransferLaneRead {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`receipts file ${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!Array.isArray(parsed)) throw new Error(`receipts file ${path} must be a JSON array of { taskId, model, family?, pass }`);
+  if (parsed.length === 0) throw new Error(`receipts file ${path} is an empty array -- zero evidence is unusable (fail-closed)`);
+
+  const warnings: string[] = [];
+  const seen = new Set<string>();
+  const results = parsed.map((entry, index) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`receipts entry ${index} in ${path} must be an object { taskId, model, family?, pass }`);
+    }
+    const record = entry as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (!RECEIPT_KNOWN_KEYS.includes(key)) {
+        warnings.push(`receipts entry ${index} in ${path} has unknown key "${key}" (ignored; known keys: ${RECEIPT_KNOWN_KEYS.join(", ")})`);
+      }
+    }
+    const taskId = record.taskId;
+    if (typeof taskId !== "string" || !taskId.trim()) throw new Error(`receipts entry ${index} in ${path}: "taskId" (non-empty string) is required`);
+    const model = record.model;
+    if (typeof model !== "string" || !model.trim()) throw new Error(`receipts entry ${index} in ${path}: "model" (non-empty string) is required`);
+    const pass = record.pass;
+    if (typeof pass !== "boolean") throw new Error(`receipts entry ${index} in ${path}: "pass" (boolean) is required -- refusing to coerce ${JSON.stringify(pass)}`);
+    let family = "default";
+    if (record.family !== undefined) {
+      if (typeof record.family !== "string" || !record.family.trim()) {
+        throw new Error(`receipts entry ${index} in ${path}: "family" must be a non-empty string when present`);
+      }
+      family = record.family;
+    }
+    const pairKey = joinKey(taskId, model);
+    if (seen.has(pairKey)) {
+      throw new Error(`duplicate taskId+model pair in ${path}: "${taskId}" + "${model}" -- refusing to guess which verdict is real (fail-closed)`);
+    }
+    seen.add(pairKey);
+    return { taskId, model, family, pass };
+  });
+  return { results, warnings, source: "receipts" };
+}
+
+function readRunnerLedger(raw: string, path: string, ledgerModel: string | undefined): TransferLaneRead {
+  const warnings: string[] = [];
+  const model = ledgerModel ?? "unspecified";
+  if (!ledgerModel) {
+    warnings.push(`runner ledger ${path}: no --model label given; ledger rows get model "unspecified" (pass --model <label> so gate joins line up)`);
+  }
+  const lines = raw.split(/\r?\n/);
+  const verdicts = new Map<string, TransferLaneResult>();
+  let sawLedgerEvent = false;
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (!line.trim()) continue;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new Error(
+        `${path}:${index + 1}: not a receipts JSON array and not a parseable runner-ledger line -- accepted inputs are a receipts array [{taskId,model,family?,pass}] or a ${RUNNER_EVENT_SCHEMA} events ledger (fail-closed)`,
+      );
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(`${path}:${index + 1}: ledger line must be a JSON object (fail-closed)`);
+    }
+    const event = parsed as Record<string, unknown>;
+    if (event.schema !== RUNNER_EVENT_SCHEMA) {
+      throw new Error(`${path}:${index + 1}: expected schema "${RUNNER_EVENT_SCHEMA}", got ${JSON.stringify(event.schema)} (fail-closed)`);
+    }
+    sawLedgerEvent = true;
+    if (event.event !== "task_completed") continue;
+    const taskId = event.taskId;
+    if (typeof taskId !== "string" || !taskId.trim()) {
+      throw new Error(`${path}:${index + 1}: task_completed event has no usable taskId (fail-closed; runner schema drift?)`);
+    }
+    const data = event.data;
+    const status = data && typeof data === "object" && !Array.isArray(data) ? (data as Record<string, unknown>).status : undefined;
+    if (status !== "passed" && status !== "failed") {
+      throw new Error(
+        `${path}:${index + 1}: task_completed data.status must be "passed" or "failed", got ${JSON.stringify(status)} (fail-closed; runner schema drift?)`,
+      );
+    }
+    // Retries after crash/resume are legitimate runner behavior: last verdict wins.
+    verdicts.set(taskId, { taskId, model, family: familyFromTaskId(taskId), pass: status === "passed" });
+  }
+  if (!sawLedgerEvent) {
+    throw new Error(`${path}: no ${RUNNER_EVENT_SCHEMA} lines found -- accepted inputs are a receipts JSON array or a runner events ledger (fail-closed)`);
+  }
+  if (verdicts.size === 0) {
+    throw new Error(`${path}: ledger contains no task_completed verdicts -- zero evidence is unusable (fail-closed)`);
+  }
+  return { results: [...verdicts.values()], warnings, source: "runner-ledger" };
+}
+
+/** Layered-plan task ids are "<lane>.<name>" (see layeredPlan.ts); the prefix is the natural family. */
+function familyFromTaskId(taskId: string): string {
+  const dot = taskId.indexOf(".");
+  return dot > 0 ? taskId.slice(0, dot) : "default";
+}
+
+function joinKey(taskId: string, model: string): string {
+  return `${taskId}${model}`;
+}
+
+// ---------------------------------------------------------------------------
+// deterministic stratified sampler
+// ---------------------------------------------------------------------------
+
+/** FNV-1a 32-bit over the seed string; feeds the xorshift32 stream. */
+function fnv1a32(text: string): number {
+  let hash = 0x811c9dc5;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 0x01000193);
+  }
+  return hash >>> 0;
+}
+
+function seededRandom(seedText: string): () => number {
+  let state = fnv1a32(seedText) || 0x9e3779b9; // xorshift must not start at 0
+  return () => {
+    state ^= state << 13;
+    state >>>= 0;
+    state ^= state >>> 17;
+    state ^= state << 5;
+    state >>>= 0;
+    return state / 0x1_0000_0000;
+  };
+}
+
+function shuffled<T>(items: readonly T[], rand: () => number): T[] {
+  const arr = items.slice();
+  for (let i = arr.length - 1; i > 0; i--) {
+    const j = Math.floor(rand() * (i + 1));
+    const tmp = arr[i];
+    arr[i] = arr[j];
+    arr[j] = tmp;
+  }
+  return arr;
+}
+
+function byFamilyTaskModel(a: { family: string; taskId: string; model: string }, b: { family: string; taskId: string; model: string }): number {
+  return a.family.localeCompare(b.family) || a.taskId.localeCompare(b.taskId) || a.model.localeCompare(b.model);
+}
+
+/**
+ * Deterministic stratified sample of the capability lane for browser
+ * certification. Same seed + same input = byte-identical plan (the per-family
+ * PRNG stream is `fnv1a(seed|family)`, so adding a family never changes
+ * another family's picks). If a family has capability failures, at least
+ * ceil(perFamily/3) of its sample slots are failures (capped by how many
+ * failures exist): failures must transfer too, or the failure path of the
+ * harness is never checked against the product.
+ */
+export function buildTransferSample(capability: readonly TransferLaneResult[], options: { seed: string; perFamily?: number }): TransferSamplePlan {
+  const seed = options.seed;
+  if (typeof seed !== "string" || !seed.trim()) {
+    throw new Error("sample requires --seed <string>; pass a commit SHA so the sample cannot be re-rolled or cherry-picked");
+  }
+  const perFamily = options.perFamily ?? DEFAULT_PER_FAMILY;
+  if (!Number.isInteger(perFamily) || perFamily < 1) throw new Error("--per-family must be an integer >= 1");
+  if (capability.length === 0) throw new Error("capability set is empty -- nothing to sample (fail-closed)");
+
+  const byFamily = new Map<string, TransferLaneResult[]>();
+  for (const result of capability) {
+    const list = byFamily.get(result.family) ?? [];
+    list.push(result);
+    byFamily.set(result.family, list);
+  }
+
+  const pairs: TransferSamplePair[] = [];
+  for (const family of [...byFamily.keys()].sort()) {
+    const members = [...(byFamily.get(family) ?? [])].sort(byFamilyTaskModel);
+    const rand = seededRandom(`${seed}|${family}`);
+    const failures = members.filter((member) => !member.pass);
+    const slots = Math.min(perFamily, members.length);
+    const failureSlots = failures.length === 0 ? 0 : Math.min(Math.ceil(perFamily / 3), failures.length, slots);
+
+    const picked = new Set<TransferLaneResult>();
+    for (const failure of shuffled(failures, rand).slice(0, failureSlots)) picked.add(failure);
+    const rest = members.filter((member) => !picked.has(member));
+    for (const member of shuffled(rest, rand).slice(0, slots - picked.size)) picked.add(member);
+
+    for (const member of [...picked].sort(byFamilyTaskModel)) {
+      pairs.push({ taskId: member.taskId, model: member.model, family: member.family, capabilityPass: member.pass });
+    }
+  }
+  pairs.sort(byFamilyTaskModel);
+  return { schema: TRANSFER_SAMPLE_SCHEMA, seed, pairs };
+}
+
+// ---------------------------------------------------------------------------
+// agreement gate
+// ---------------------------------------------------------------------------
+
+export function evaluateTransferGate(
+  capability: readonly TransferLaneResult[],
+  browser: readonly TransferLaneResult[],
+  options: { minAgreement?: number; minOverlap?: number; allowNoFailureOverlap?: boolean } = {},
+): TransferGateEvaluation {
+  const minAgreement = options.minAgreement ?? DEFAULT_MIN_AGREEMENT;
+  if (!Number.isFinite(minAgreement) || minAgreement < 0 || minAgreement > 1) {
+    throw new Error("--min-agreement must be a number between 0 and 1");
+  }
+  const requestedMinOverlap = options.minOverlap ?? DEFAULT_MIN_OVERLAP;
+  if (!Number.isInteger(requestedMinOverlap)) throw new Error("--min-overlap must be an integer");
+  // Never certify zero evidence, no matter what the caller asked for.
+  const minOverlap = Math.max(1, requestedMinOverlap);
+
+  const capabilityByKey = new Map<string, TransferLaneResult>();
+  for (const result of capability) capabilityByKey.set(joinKey(result.taskId, result.model), result);
+
+  const paired: Array<{ cap: TransferLaneResult; browser: TransferLaneResult }> = [];
+  for (const browserResult of [...browser].sort(byFamilyTaskModel)) {
+    const cap = capabilityByKey.get(joinKey(browserResult.taskId, browserResult.model));
+    if (cap) paired.push({ cap, browser: browserResult });
+  }
+
+  const overlap = paired.length;
+  const capabilityFailuresTotal = capability.filter((result) => !result.pass).length;
+  const pairedCapabilityFailures = paired.filter((pair) => !pair.cap.pass).length;
+  const matches = paired.filter((pair) => pair.cap.pass === pair.browser.pass).length;
+  const agreementRatio = overlap === 0 ? 0 : matches / overlap;
+  const disagreements: TransferDisagreement[] = paired
+    .filter((pair) => pair.cap.pass !== pair.browser.pass)
+    .map((pair) => {
+      const direction: TransferDisagreementDirection = pair.cap.pass ? "capability-pass-browser-fail" : "capability-fail-browser-pass";
+      return {
+        taskId: pair.cap.taskId,
+        model: pair.cap.model,
+        family: pair.cap.family,
+        capabilityPass: pair.cap.pass,
+        browserPass: pair.browser.pass,
+        direction,
+        label: TRANSFER_DIRECTION_LABELS[direction],
+      };
+    });
+
+  const base = {
+    overlap,
+    matches,
+    agreementRatio,
+    minAgreement,
+    minOverlap,
+    capabilityFailuresTotal,
+    pairedCapabilityFailures,
+    disagreements,
+    warnings: [] as string[],
+  };
+
+  if (overlap < minOverlap) {
+    return {
+      status: "unusable",
+      reason:
+        overlap === 0
+          ? "zero paired taskId+model verdicts between the capability and browser lanes -- zero evidence can never certify agreement"
+          : `paired overlap ${overlap} is below --min-overlap ${minOverlap} -- too little evidence to certify agreement`,
+      ...base,
+    };
+  }
+
+  if (capabilityFailuresTotal > 0 && pairedCapabilityFailures === 0) {
+    if (!options.allowNoFailureOverlap) {
+      return {
+        status: "unusable",
+        reason:
+          `cherry-pick guard: the capability set contains ${capabilityFailuresTotal} failure(s) but the browser paired set contains ZERO of them; ` +
+          "a sample that dodges every failure cannot certify the failure path (pass --allow-no-failure-overlap to override with a loud warning)",
+        ...base,
+      };
+    }
+    base.warnings.push(
+      `WARNING: --allow-no-failure-overlap: the capability set contains ${capabilityFailuresTotal} failure(s) but the browser paired set includes NONE of them. ` +
+        "Harness shortcuts on the failure path remain UNVERIFIED; this agreement claim is weaker than the standard transfer gate.",
+    );
+  }
+
+  return {
+    status: agreementRatio >= minAgreement - AGREEMENT_EPSILON ? "agreed" : "diverged",
+    ...base,
+  };
+}
+
+/**
+ * The doctrine claim line printed on exit 0 -- deliberately scoped language.
+ * The browser lane certified a stratified sample, so the only honest claim is
+ * "capability lane verified + transfer verified on N seeded pairs", never
+ * "all tasks browser-verified".
+ */
+export function transferClaimLine(evaluation: TransferGateEvaluation): string {
+  return (
+    `Capability verified through the live agent harness; production browser path verified by stratified UI certification ` +
+    `(agreement ${formatPercent(evaluation.agreementRatio)}% on ${evaluation.overlap} seeded pairs including ` +
+    `${evaluation.pairedCapabilityFailures} capability-failures). This is NOT an all-tasks-browser-verified claim.`
+  );
+}
+
+function formatPercent(ratio: number): string {
+  const rounded = Math.round(ratio * 1000) / 10;
+  return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+type TransferCheckIo = {
+  log?: (line: string) => void;
+  logError?: (line: string) => void;
+};
+
+function strOption(value: string | boolean | undefined): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+function intOption(value: string | boolean | undefined, flag: string): number | undefined {
+  const raw = strOption(value);
+  if (raw === undefined) {
+    if (value === true) throw new Error(`${flag} requires a value`);
+    return undefined;
+  }
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed)) throw new Error(`${flag} must be an integer, got ${JSON.stringify(raw)}`);
+  return parsed;
+}
+
+function floatOption(value: string | boolean | undefined, flag: string): number | undefined {
+  const raw = strOption(value);
+  if (raw === undefined) {
+    if (value === true) throw new Error(`${flag} requires a value`);
+    return undefined;
+  }
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed)) throw new Error(`${flag} must be a number, got ${JSON.stringify(raw)}`);
+  return parsed;
+}
+
+function resolveLane(root: string, path: string): string {
+  return isAbsolute(path) ? path : resolve(root, path);
+}
+
+/**
+ * `proofloop transfer-check sample|gate`. Exit codes:
+ *   sample: 0 wrote/printed the plan, 2 unusable input or bad flags.
+ *   gate:   0 agreed, 1 diverged, 2 unusable (fail-closed).
+ */
+export function runTransferCheckCommand(
+  sub: string | undefined,
+  options: Record<string, string | boolean>,
+  root: string,
+  io: TransferCheckIo = {},
+): number {
+  const log = io.log ?? console.log;
+  const logError = io.logError ?? console.error;
+  try {
+    if (sub === "sample") return runSample(options, root, log, logError);
+    if (sub === "gate") return runGateSub(options, root, log, logError);
+    logError("proofloop transfer-check: expected `sample` or `gate`.");
+    return 2;
+  } catch (error) {
+    logError(`proofloop transfer-check: ${error instanceof Error ? error.message : String(error)} (fail-closed, exit 2)`);
+    return 2;
+  }
+}
+
+function runSample(options: Record<string, string | boolean>, root: string, log: (line: string) => void, logError: (line: string) => void): number {
+  const capabilityPath = strOption(options.capability);
+  if (!capabilityPath) throw new Error("sample requires --capability <file>");
+  const seed = strOption(options.seed);
+  if (!seed) throw new Error("sample requires --seed <string>; pass a commit SHA so the sample cannot be re-rolled or cherry-picked");
+  const perFamily = intOption(options["per-family"], "--per-family");
+
+  const lane = readTransferLaneResults(resolveLane(root, capabilityPath), { ...(strOption(options.model) !== undefined ? { ledgerModel: strOption(options.model)! } : {}) });
+  for (const warning of lane.warnings) logError(`proofloop transfer-check: warning: ${warning}`);
+
+  const plan = buildTransferSample(lane.results, { seed, ...(perFamily !== undefined ? { perFamily } : {}) });
+  const serialized = JSON.stringify(plan, null, 2);
+  const outPath = strOption(options.out);
+  if (outPath) {
+    const resolved = resolveLane(root, outPath);
+    mkdirSync(dirname(resolved), { recursive: true });
+    writeFileSync(resolved, `${serialized}\n`, "utf8");
+    logError(`proofloop transfer-check: wrote sample plan to ${resolved}`);
+  }
+  log(serialized);
+  return 0;
+}
+
+function runGateSub(options: Record<string, string | boolean>, root: string, log: (line: string) => void, logError: (line: string) => void): number {
+  const capabilityPath = strOption(options.capability);
+  const browserPath = strOption(options.browser);
+  if (!capabilityPath || !browserPath) throw new Error("gate requires --capability <file> and --browser <file>");
+  const minAgreement = floatOption(options["min-agreement"], "--min-agreement");
+  const minOverlap = intOption(options["min-overlap"], "--min-overlap");
+  const ledgerModel = strOption(options.model);
+
+  const capability = readTransferLaneResults(resolveLane(root, capabilityPath), { ...(ledgerModel !== undefined ? { ledgerModel } : {}) });
+  const browser = readTransferLaneResults(resolveLane(root, browserPath), { ...(ledgerModel !== undefined ? { ledgerModel } : {}) });
+  for (const warning of [...capability.warnings, ...browser.warnings]) logError(`proofloop transfer-check: warning: ${warning}`);
+
+  const evaluation = evaluateTransferGate(capability.results, browser.results, {
+    ...(minAgreement !== undefined ? { minAgreement } : {}),
+    ...(minOverlap !== undefined ? { minOverlap } : {}),
+    allowNoFailureOverlap: options["allow-no-failure-overlap"] === true,
+  });
+
+  if (evaluation.status === "unusable") {
+    logError(`proofloop transfer-check: UNUSABLE -- ${evaluation.reason} (fail-closed, exit 2)`);
+    return 2;
+  }
+
+  for (const warning of evaluation.warnings) log(`proofloop transfer-check: ${warning}`);
+
+  if (evaluation.status === "diverged") {
+    log(
+      `proofloop transfer-check: DIVERGED -- agreement ${formatPercent(evaluation.agreementRatio)}% < required ` +
+        `${formatPercent(evaluation.minAgreement)}% on ${evaluation.overlap} paired verdicts.`,
+    );
+    log("  disagreements:");
+    for (const disagreement of evaluation.disagreements) {
+      log(
+        `    - ${disagreement.taskId} [${disagreement.model} / ${disagreement.family}] ` +
+          `capability=${disagreement.capabilityPass ? "pass" : "fail"} browser=${disagreement.browserPass ? "pass" : "fail"} -> ${disagreement.label}`,
+      );
+    }
+    log("  Do not publish the capability-lane score until each divergence is root-caused.");
+    return 1;
+  }
+
+  log(`proofloop transfer-check: AGREED -- ${evaluation.matches}/${evaluation.overlap} paired verdicts match.`);
+  log(transferClaimLine(evaluation));
+  return 0;
+}
diff --git a/tests/transferCheck.test.ts b/tests/transferCheck.test.ts
new file mode 100644
index 0000000..1e9adf9
--- /dev/null
+++ b/tests/transferCheck.test.ts
@@ -0,0 +1,369 @@
+/**
+ * Scenario tests for `proofloop transfer-check` -- the two-layer certification
+ * agreement gate.
+ *
+ * Persona: a release engineer certifies an agentic finance workflow. The
+ * capability lane ran ALL benchmark tasks through the live agent harness
+ * (cheap, headless); the browser lane replayed a seeded stratified sample
+ * through the real production UI. These tests drive the REAL compiled
+ * dist/cli.js as a subprocess in mkdtemp dirs -- no in-process shortcuts --
+ * and cover happy path, divergence (both directions), starvation (overlap),
+ * adversarial cherry-picking, determinism, failure stratification, the
+ * runner-ledger reader, and malformed/duplicate input rejection.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import type { TransferSamplePlan } from "../src/transferCheck";
+
+const REPO_ROOT = join(__dirname, "..");
+const CLI_DIST = join(REPO_ROOT, "dist", "cli.js");
+
+const tempRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of tempRoots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function tempRoot(): string {
+  const root = mkdtempSync(join(tmpdir(), "proofloop-transfer-"));
+  tempRoots.push(root);
+  return root;
+}
+
+function runCli(args: string[]): { status: number; stdout: string; stderr: string } {
+  const result = spawnSync(process.execPath, [CLI_DIST, ...args], {
+    cwd: REPO_ROOT,
+    encoding: "utf8",
+    timeout: 60_000,
+  });
+  return { status: result.status ?? -1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+
+type ReceiptRow = Record<string, unknown>;
+
+function writeReceipts(root: string, name: string, rows: ReceiptRow[]): string {
+  const path = join(root, name);
+  writeFileSync(path, `${JSON.stringify(rows, null, 2)}\n`, "utf8");
+  return path;
+}
+
+function receipt(taskId: string, pass: boolean, family = "banker", model = "glm-4.7"): ReceiptRow {
+  return { taskId, model, family, pass };
+}
+
+/**
+ * The standard 20-task capability fixture: 2 families x 10 tasks, mixed
+ * pass/fail. "banker" has 2 failures (20%); "sheets" has 4 failures (40%).
+ */
+function capability20(root: string): string {
+  const rows: ReceiptRow[] = [];
+  for (let i = 1; i <= 10; i++) {
+    const id = `b${String(i).padStart(2, "0")}`;
+    rows.push(receipt(id, !(i === 7 || i === 8), "banker"));
+  }
+  for (let i = 1; i <= 10; i++) {
+    const id = `s${String(i).padStart(2, "0")}`;
+    rows.push(receipt(id, !(i >= 6 && i <= 9), "sheets"));
+  }
+  return writeReceipts(root, "capability-20.json", rows);
+}
+
+describe("transfer-check gate: agreement pass (exit 0)", () => {
+  it("has the compiled CLI available (build before test)", () => {
+    expect(existsSync(CLI_DIST), "dist/cli.js must be built before running the CLI test (run `npm run build`)").toBe(true);
+  });
+
+  it("100% agreement including capability-failures prints the doctrine claim line verbatim and exits 0", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(root, "capability.json", [
+      receipt("t1", true),
+      receipt("t2", true),
+      receipt("t3", true),
+      receipt("t4", true),
+      receipt("t5", false),
+      receipt("t6", false),
+    ]);
+    // The browser lane replays the same 6 tasks in the real UI and agrees on
+    // every verdict -- including both failures (a failure that transfers is
+    // evidence the harness failure was real, not an env artifact).
+    const browser = writeReceipts(root, "browser.json", [
+      receipt("t1", true),
+      receipt("t2", true),
+      receipt("t3", true),
+      receipt("t4", true),
+      receipt("t5", false),
+      { ...receipt("t6", false), notes: "flaky selector, retried once" }, // unknown key -> warn, not reject
+    ]);
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(result.stderr).toContain('unknown key "notes"');
+    expect(result.stdout).toContain("AGREED");
+    expect(result.stdout).toContain(
+      "Capability verified through the live agent harness; production browser path verified by stratified UI certification " +
+        "(agreement 100% on 6 seeded pairs including 2 capability-failures). This is NOT an all-tasks-browser-verified claim.",
+    );
+    expect(result.status).toBe(0);
+  });
+
+  it("passes at exactly the threshold (9/10 agreement at --min-agreement 0.9, no float-noise false fail)", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(
+      root,
+      "capability.json",
+      Array.from({ length: 10 }, (_, i) => receipt(`c${i + 1}`, i < 8)), // c9, c10 fail
+    );
+    const browser = writeReceipts(
+      root,
+      "browser.json",
+      Array.from({ length: 10 }, (_, i) => {
+        if (i === 9) return receipt("c10", true); // single disagreement: capability-fail / browser-pass
+        return receipt(`c${i + 1}`, i < 8);
+      }),
+    );
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser, "--min-agreement", "0.9"]);
+    expect(result.stdout).toContain("agreement 90% on 10 seeded pairs including 2 capability-failures");
+    expect(result.status).toBe(0);
+  });
+});
+
+describe("transfer-check gate: divergence (exit 1)", () => {
+  it("fails with a per-pair table labeling BOTH disagreement directions distinctly", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(root, "capability.json", [
+      receipt("a1", true),
+      receipt("a2", false),
+      receipt("a3", true),
+      receipt("a4", false),
+      receipt("a5", true),
+      receipt("a6", false),
+    ]);
+    const browser = writeReceipts(root, "browser.json", [
+      receipt("a1", false), // capability-pass / browser-fail: the harness claimed a pass the product cannot reproduce
+      receipt("a2", true), //  capability-fail / browser-pass: the harness under-reports; env gap or harness bug
+      receipt("a3", true),
+      receipt("a4", false),
+      receipt("a5", true),
+      receipt("a6", false),
+    ]);
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(result.status).toBe(1);
+    expect(result.stdout).toContain("DIVERGED");
+    expect(result.stdout).toContain("a1 [glm-4.7 / banker] capability=pass browser=fail -> suspected harness shortcut or product-path break -- capability claim suspect");
+    expect(result.stdout).toContain("a2 [glm-4.7 / banker] capability=fail browser=pass -> suspected harness bug or env gap -- capability lane under-reporting");
+    // The two directions must be labeled DIFFERENTLY -- they demand different investigations.
+    expect(result.stdout).toContain("capability claim suspect");
+    expect(result.stdout).toContain("capability lane under-reporting");
+    expect(result.stdout).not.toContain("This is NOT an all-tasks-browser-verified claim."); // no claim line on divergence
+  });
+});
+
+describe("transfer-check gate: unusable evidence (exit 2, fail-closed)", () => {
+  it("refuses when paired overlap is below --min-overlap", () => {
+    const root = tempRoot();
+    const capability = capability20(root);
+    const browser = writeReceipts(root, "browser.json", [receipt("b01", true), receipt("b02", true), receipt("b07", false)]);
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("paired overlap 3 is below --min-overlap 5");
+    expect(result.stderr).toContain("fail-closed");
+  });
+
+  it("never exits 0 on zero evidence, even when the caller passes --min-overlap 0", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(root, "capability.json", [receipt("x1", true), receipt("x2", false)]);
+    const browser = writeReceipts(root, "browser.json", [receipt("unrelated-1", true)]); // disjoint: no joinable pairs
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser, "--min-overlap", "0"]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("zero paired taskId+model verdicts");
+  });
+
+  it("refuses unreadable lane input (garbage file) instead of guessing", () => {
+    const root = tempRoot();
+    const capability = join(root, "garbage.json");
+    writeFileSync(capability, "this is not json at all\n", "utf8");
+    const browser = writeReceipts(root, "browser.json", [receipt("t1", true)]);
+
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("fail-closed");
+  });
+});
+
+describe("transfer-check gate: cherry-pick guard (adversarial)", () => {
+  // The agent under certification would love a browser sample containing only
+  // its passes -- then a memory-mode shortcut in the harness failure path can
+  // never be caught. That sample is refused by default.
+  function cherryPickFixture(root: string): { capability: string; browser: string } {
+    const capability = writeReceipts(root, "capability.json", [
+      receipt("t1", true),
+      receipt("t2", true),
+      receipt("t3", true),
+      receipt("t4", true),
+      receipt("t5", true),
+      receipt("t6", false),
+      receipt("t7", false),
+    ]);
+    const browser = writeReceipts(root, "browser.json", [
+      receipt("t1", true),
+      receipt("t2", true),
+      receipt("t3", true),
+      receipt("t4", true),
+      receipt("t5", true), // 5 pairs (meets min-overlap) but ZERO capability-failures sampled
+    ]);
+    return { capability, browser };
+  }
+
+  it("refuses (exit 2) when capability has failures but the browser paired set contains none of them", () => {
+    const root = tempRoot();
+    const { capability, browser } = cherryPickFixture(root);
+    const result = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("cherry-pick guard");
+    expect(result.stderr).toContain("ZERO");
+  });
+
+  it("proceeds with a loud warning when --allow-no-failure-overlap is passed explicitly", () => {
+    const root = tempRoot();
+    const { capability, browser } = cherryPickFixture(root);
+    const result = runCli([
+      "transfer-check", "gate",
+      "--capability", capability,
+      "--browser", browser,
+      "--allow-no-failure-overlap",
+    ]);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("WARNING: --allow-no-failure-overlap");
+    expect(result.stdout).toContain("UNVERIFIED");
+    // The claim line stays honest about having certified zero failures.
+    expect(result.stdout).toContain("including 0 capability-failures");
+  });
+});
+
+describe("transfer-check sample: seeded deterministic stratified sampler", () => {
+  it("same seed + same input = byte-identical sample JSON; different seed = different sample", () => {
+    const root = tempRoot();
+    const capability = capability20(root);
+
+    const first = runCli(["transfer-check", "sample", "--capability", capability, "--seed", "sha-alpha-1111"]);
+    const second = runCli(["transfer-check", "sample", "--capability", capability, "--seed", "sha-alpha-1111"]);
+    expect(first.status).toBe(0);
+    expect(second.status).toBe(0);
+    expect(second.stdout).toBe(first.stdout); // byte-identical
+
+    const plan = JSON.parse(first.stdout) as TransferSamplePlan;
+    expect(plan.schema).toBe("proofloop-transfer-sample-v1");
+    expect(plan.seed).toBe("sha-alpha-1111");
+    expect(plan.pairs.length).toBe(10); // 5 per family x 2 families
+
+    const other = runCli(["transfer-check", "sample", "--capability", capability, "--seed", "sha-beta-2222"]);
+    expect(other.status).toBe(0);
+    const otherPlan = JSON.parse(other.stdout) as TransferSamplePlan;
+    const firstKeys = new Set(plan.pairs.map((pair) => `${pair.taskId}+${pair.model}`));
+    const differing = otherPlan.pairs.filter((pair) => !firstKeys.has(`${pair.taskId}+${pair.model}`));
+    expect(differing.length).toBeGreaterThanOrEqual(1); // statistically distinct on the 20-task fixture
+  });
+
+  it("requires --seed (a commit SHA) so the agent cannot re-roll the sample until it likes it", () => {
+    const root = tempRoot();
+    const capability = capability20(root);
+    const result = runCli(["transfer-check", "sample", "--capability", capability]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("--seed");
+    expect(result.stderr).toContain("cherry-picked");
+  });
+
+  it("includes at least ceil(N/3) capability-failures per family that has failures (40% failures at N=6 -> >=2 failure slots)", () => {
+    const root = tempRoot();
+    const capability = capability20(root); // sheets: 4/10 failures; banker: 2/10 failures
+
+    const result = runCli(["transfer-check", "sample", "--capability", capability, "--per-family", "6", "--seed", "42cd067"]);
+    expect(result.status).toBe(0);
+    const plan = JSON.parse(result.stdout) as TransferSamplePlan;
+
+    const sheets = plan.pairs.filter((pair) => pair.family === "sheets");
+    expect(sheets.length).toBe(6);
+    expect(sheets.filter((pair) => !pair.capabilityPass).length).toBeGreaterThanOrEqual(2); // ceil(6/3) = 2
+
+    const banker = plan.pairs.filter((pair) => pair.family === "banker");
+    expect(banker.length).toBe(6);
+    expect(banker.filter((pair) => !pair.capabilityPass).length).toBeGreaterThanOrEqual(2); // both banker failures must be in
+  });
+});
+
+describe("transfer-check lane readers", () => {
+  it("derives per-task verdicts from a real runner events ledger (task_completed data.status; retry last-wins)", () => {
+    const root = tempRoot();
+    const at = "2026-07-05T00:00:00.000Z";
+    const lines = [
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "runner_started", data: { subcommand: "run", budgetUsd: 100, maxTasks: null } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "task_started", taskId: "capability.tests", data: { command: "npm test", cwd: ".", envKeys: [], estimatedCostUsd: 0 } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "task_completed", taskId: "capability.tests", data: { status: "passed", exitCode: 0, signal: null, stdout: "", stderr: "" } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "task_completed", taskId: "capability.lint", data: { status: "failed", exitCode: 1, signal: null, stdout: "", stderr: "lint error" } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "stale_running_requeued", taskId: "capability.lint", data: { previousStartedAt: at } },
+      // Resume retried the lint task and it passed: the LAST completed verdict wins.
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "task_completed", taskId: "capability.lint", data: { status: "passed", exitCode: 0, signal: null, stdout: "", stderr: "" } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "task_completed", taskId: "browser.e2e", data: { status: "failed", exitCode: 1, signal: null, stdout: "", stderr: "" } },
+      { schema: "proofloop-runner-event-v1", runId: "r1", at, event: "runner_finished", data: { status: "failed", spentEstimatedUsd: 0 } },
+    ];
+    const ledgerPath = join(root, "ledger.jsonl");
+    writeFileSync(ledgerPath, `${lines.map((line) => JSON.stringify(line)).join("\n")}\n`, "utf8");
+
+    const result = runCli(["transfer-check", "sample", "--capability", ledgerPath, "--seed", "sha-ledger", "--model", "glm-4.7"]);
+    expect(result.status).toBe(0);
+    const plan = JSON.parse(result.stdout) as TransferSamplePlan;
+    const byId = new Map(plan.pairs.map((pair) => [pair.taskId, pair]));
+
+    expect(byId.get("capability.tests")).toMatchObject({ family: "capability", model: "glm-4.7", capabilityPass: true });
+    expect(byId.get("capability.lint")).toMatchObject({ family: "capability", model: "glm-4.7", capabilityPass: true }); // retry won
+    expect(byId.get("browser.e2e")).toMatchObject({ family: "browser", model: "glm-4.7", capabilityPass: false });
+  });
+
+  it("warns loudly when a ledger is read without --model (joins would silently miss)", () => {
+    const root = tempRoot();
+    const ledgerPath = join(root, "ledger.jsonl");
+    const line = {
+      schema: "proofloop-runner-event-v1", runId: "r1", at: "2026-07-05T00:00:00.000Z",
+      event: "task_completed", taskId: "capability.tests",
+      data: { status: "passed", exitCode: 0, signal: null, stdout: "", stderr: "" },
+    };
+    writeFileSync(ledgerPath, `${JSON.stringify(line)}\n`, "utf8");
+
+    const result = runCli(["transfer-check", "sample", "--capability", ledgerPath, "--seed", "s"]);
+    expect(result.status).toBe(0);
+    expect(result.stderr).toContain('model "unspecified"');
+  });
+
+  it("rejects duplicate taskId+model pairs in a receipts file (exit 2) -- two verdicts for one task is untrustworthy input", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(root, "capability.json", [
+      receipt("t1", true),
+      receipt("t2", true),
+      receipt("t1", false), // same taskId+model, contradictory verdict
+    ]);
+    const result = runCli(["transfer-check", "sample", "--capability", capability, "--seed", "s"]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain("duplicate taskId+model");
+
+    const browser = writeReceipts(root, "browser.json", [receipt("t1", true)]);
+    const gate = runCli(["transfer-check", "gate", "--capability", capability, "--browser", browser]);
+    expect(gate.status).toBe(2);
+    expect(gate.stderr).toContain("duplicate taskId+model");
+  });
+
+  it("rejects receipts entries with missing required fields instead of coercing", () => {
+    const root = tempRoot();
+    const capability = writeReceipts(root, "capability.json", [
+      { taskId: "t1", model: "glm-4.7", family: "banker", pass: "true" }, // string, not boolean
+    ]);
+    const result = runCli(["transfer-check", "sample", "--capability", capability, "--seed", "s"]);
+    expect(result.status).toBe(2);
+    expect(result.stderr).toContain('"pass" (boolean) is required');
+  });
+});