[stephenctw]

Reject out-of-range frame fees before the scheduler applies any frame, preventing malformed batches from halting the canonical guest. Preserve the batch nonce and overdue-direct backstop. Unit, duality and real-machine regressions cover the boundary.

Verify external watchdog init/replay checkpoints against their stored hash trees. Keep the release manifest's kernel metadata aligned with the existing toolchain pins, and exercise manifest generation in CI. The kernel download verification and RPC URL redaction already present on main remain unchanged.

Document operator shutdown before guardian foreclosure and prohibit restarting a foreclosed application. This change adds no expiry protocol, emergency-exit machinery or foreclosure RPC gates; existing signing, wire, storage and fee formats and warm-restart behavior are preserved.

Validation:

• 823 Rust workspace tests passed (--workspace --exclude canonical-test).
• All 16 canonical guest tests passed on a rebuilt emulator 0.22.0 image, including the fee-bound regression and v1 golden vectors.
• All 64 watchdog unit tests and the real-machine stale-sidecar regression passed.
• The restored warm-restart-with-L1-down end-to-end scenario passed.
• Workspace/all-targets cargo check and Clippy with warnings denied, Rust formatting, Lua lint, release-manifest generation and toolchain-pin checks passed.

The complete rollups/watchdog end-to-end suites were not rerun locally.

[GCdePaula]

Approving. Thanks for the quick, clean rewrite: every item from the review is done, nothing from the removed parts remains, and CI is green.

Optional nits, fine to skip or to fold into a later PR:

• sequencer/src/storage/safe_accepted_batches.rs:755 still says scheduler_accepts omits "the two structural" rejections; there are now three.
• watchdog/machine.lua:147: the pcall drops the emulator's error text, so a host-level failure reads as "fails hash-tree verification". Consider appending tostring(valid) to the message when not ok, as load already does.
• The 5d3a15e title says it verifies the kernel manifest metadata; the commit only records the pins in the manifest.
• The 52e9b57 message could say it changes a canonical acceptance rule and moves the template hash, for whoever writes the release notes.

Outside the code: Bart should hear that the out-of-range fee rule is now settled, since the C++ port must reject the same batches. The release notes will also need the new devnet and Sepolia template hashes.