diff --git a/docs/findings.md b/docs/findings.md
index 86fe807..3cbcf7b 100644
--- a/docs/findings.md
+++ b/docs/findings.md
@@ -241,6 +241,37 @@ The four new scenarios, built for what `v0.29.0` to `v0.40.0` added, passed in b
 
 The test bed's workflow gained the scan's `outputs:`, `apply-merged` and a `settle` that waits for both, as the action's `docs/split-workflow.md` asks for a stack set to on-merge, and `schedule` in the `if:` of `resolve`, for deploy windows. `versions.json` now also holds `SLUICEWAY_VERSION`, the release those tool versions were read from, and the driver verifies it when no `--version` is given.
 
+## 2026-09-26: the verification against v0.44.0
+
+The driver ran against `v0.44.0` (`997546c`), the newest release, on 2026-09-25 from 22:26 to 23:35 UTC, a local run with the owner's `gh` login as the ticker, in 1,223 requests. The tool versions are unchanged: the action's `e2e.yml` at the tag still pins Pulumi v3.263.0 and OpenTofu 1.12.6.
+
+| Run | Scenarios | Passed | Failed | Skipped |
+|---|---|---|---|---|
+| `v0.41.0`, the last of 2026-09-25 | 1 to 34 | 34 | 3 (22, 23, 30) | 3 |
+| `v0.44.0` | 1 to 37 | 42 | 0 | 3 |
+
+The counts are cells of the summary, a scenario per adapter. The skips are the same as before: 21 and the `admin` part of 7 need a second account. The runs of the test bed are deleted by the next reset; the job logs and everything the driver read are kept in the local output of the run.
+
+The three failures of `v0.41.0` pass, each because its fix shipped in `v0.42.2`, and each assertion now checks the fix itself, not only the symptom:
+
+- **22, after the tick: fixed by [#274](https://github.com/sluiceway/sluiceway/pull/274), record 0111, for [#270](https://github.com/sluiceway/sluiceway/issues/270).** The push landed while `apply` was held; `apply` compared the commit it checked out with `main`, refused with `main moved on from <commit>, the commit this run checked out, to a commit that changes a file pulumi/plain/greeting:prod claims: pulumi/plain/greeting/Pulumi.yaml.`, ran no fresh preview, ended the record `error`, "the change moved since the tick", and started a full scan. That scan wrote the row pending with the new hash (`creates="3"`) and the failure line, and the comment says `a newer commit reached the branch before the deploy started`. The row was never in sync. The stale-row half passes as before.
+- **23, the minute: fixed by [#275](https://github.com/sluiceway/sluiceway/pull/275), record 0113, for [#272](https://github.com/sluiceway/sluiceway/issues/272).** `settle` wrote the row itself 30 seconds after the cancel (44 to 63 seconds on `v0.41.0`, and 101 on `v0.26.1`): `no preview since its deploy ended, the next scan previews it`, state `preview-failed`, no box, the failure line right under it, and the log line `Wrote the failure line on the row of pulumi/states/slow:prod, before the full scan previews it again (record 0113).` The scan after it left the pending row with the same failure line. The re-run half passes as before.
+- **30: fixed by [#273](https://github.com/sluiceway/sluiceway/pull/273), record 0112, for [#271](https://github.com/sluiceway/sluiceway/issues/271).** The row holds `<span>#</span>1 <span>@</span>sluiceway www&#46;example.com &#42;x&#42;`, and neither the dashboard as GitHub renders it nor the preview page through `POST /markdown` holds an issue link, a mention, an autolink or emphasis in the name.
+
+Three new scenarios, for what `v0.42.0` to `v0.44.0` added, passed:
+
+- **35, a deploy freeze** (record 0115): a push adds a freeze from 23:14 to 23:24 UTC with a reason. The dashboard says `Deploy freeze until 2026-09-25 23:24 UTC (Release verification freeze): every deploy waits for it to end.` A tick on `greeting:dev` inside it opened a record with `window: true`, started no `apply`, and the row read `queued for the end of the deploy freeze (Release verification freeze) at 2026-09-25 23:24 UTC · ticked by robbeverhelst`. "Run workflow" after the end ended that record as "started in a later run" and deployed it in a record of its own with the same hash, and the freeze line was gone.
+- **36, the layout keys** (record 0114): at `pendingDetail: compact` with `inSyncSection: off`, every pending row kept its `:warning: DELETE` and `REPLACE` lines and its failure line and lost its folds of changes, every marker was the one the full layout wrote, the two in sync rows sat whole in `2 stacks in sections this dashboard does not show`, and the counts line still counted them. Taking the keys out brought the heading, the ignored stacks and the folds back.
+- **37, counts on a pending row's marker** (record 0110): on every pending row a scan of a step wrote, `creates`, `updates`, `replaces`, `deletes` and `destroys` match the result file and the first line, and the run met each of them. `tracking` and the `behind` of a queued row were not met: no fixture moves a resource, and no scenario queues a stack behind another.
+
+The harness changed in three ways besides:
+
+- **33 across midnight.** It used to skip itself when the window would open after 23:00 UTC. It now writes an hour that crosses midnight as two windows, to `24:00` and from `00:00`, and this run met exactly that: the window opened at 23:14 UTC.
+- **The shared test bed.** The driver now waits until the newest commit of the test bed ends in `: done` before its reset, and hands the test bed back with a `: done` commit even when it fails.
+- **Logs as runs end.** Each run's logs are kept the moment it is seen completed, in `logs/` of the output, instead of only when the step ends.
+
+No bug of the action was found, so nothing was filed.
+
 ## 2026-09-22: the acceptance checklist, triaged, against v0.26.0
 
 The action's `docs/acceptance.md` at `v0.26.0` has 60 unticked items. Each one is sorted below by what can prove it: a scenario of the [release verification](release-verification.md) that passes today, a scenario that is planned or new, or a person. The checklist is written for one setup, a private repo with self-hosted runners, a real secret manager and a wrapper script around the tool, and a row says so when that setup, not the feature, is what keeps an item off a runner. File and line refer to the action at `v0.26.0`.
diff --git a/docs/release-verification.md b/docs/release-verification.md
index 5040b96..7feebd6 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -115,19 +115,22 @@ A step is a push, an edit, a pull request or a dispatch. "Tick" means the scenar
 | 19 | Outputs and the result file | All | Nothing, reads every step. | Every result file validates against `schema/result-file.schema.json` at the tag. The outputs of each step agree with its result file and with GitHub: counts with the body, `stack`, `outcome` and the ticker with the record. | No | 0 |
 | 20 | `showValues` and the leak check | All | `showValues` lists one path. A push changes the value at that path and at one path that is not listed. | The listed change reads `old → new`. The other shows its path only. Then the leak check, below. | No | 3 min, then 2 min of reads |
 | 21 | Two ticks within seconds, by two people | Pu, Tofu | The bot ticks `greeting:prod`, and two seconds later a second account ticks `opentofu/notes` in an edit of its own. Runs only when `RELEASE_VERIFY_SECOND_TICKER_TOKEN` is set, and is reported as skipped otherwise. | One record per stack, each with its own ticker in the payload and in `apply`'s result file, each ended `success`; one `apply` per stack; both rows in sync; the trail names each stack with its own ticker. | Yes, and the second account | 4 min |
-| 22 | A change that moved before apply | Pu | Twice. After the tick: the bot ticks `greeting:prod`, the test bed's `apply` job waits at its first step while the branch `release-verify-hold-apply` exists, the driver pushes a change to that stack and waits for its scan, then deletes the branch. A stale row: the scan job waits while `release-verify-hold-scan` exists, the driver pushes a change to `greeting:dev` and ticks its row as the scan before wrote it, then releases the scan. | Each time, as records 0008, 0051 and 0052 and the checklist's item 9 say: one record, ended `error`, "the change moved since the tick"; `apply` red with `outcome` `refused`, its result file's reason and the log line `<stack> was not deployed: the change moved since the tick.`; one comment that mentions the ticker, word for word; the row pending with a box, a new hash, `failed="true"` and the line `:x: last deploy failed: the change moved since the tick · ticked by <bot>`. | Yes | 5 min |
-| 23 | A cancelled deploy, then "Re-run failed jobs" | Pu | A push of `pulumi/states/slow`, whose deploy sleeps for five minutes. The bot ticks it, and ten seconds after its record is `in_progress` the driver cancels the run. Then it calls "Re-run failed jobs" on that run. | After the cancel: the record ends `error`, "the run ended without a result"; `settle` logs that it ended the record and started a full scan; that scan puts `:x: last deploy failed: the run ended without a result · ticked by <bot>` and `failed="true"` on the row, within 60 seconds of the cancel, as the edit history dates it. After the re-run: no new record and no new status; attempt 2 of `apply` is red with `outcome` `refused` and logs `Deployment record N already ended as error. Nothing is deployed. A re-run never deploys (record 0019).` and `This deploy already ended. Tick the box on the dashboard to try again.`; `settle` logs that no record of the run is open; the row is as before. | Yes | 8 min |
+| 22 | A change that moved before apply | Pu | Twice. After the tick: the bot ticks `greeting:prod`, the test bed's `apply` job waits at its first step while the branch `release-verify-hold-apply` exists, the driver pushes a change to that stack and waits for its scan, then deletes the branch. A stale row: the scan job waits while `release-verify-hold-scan` exists, the driver pushes a change to `greeting:dev` and ticks its row as the scan before wrote it, then releases the scan. | Each time, as records 0008, 0051 and 0052 and the checklist's item 9 say: one record, ended `error`, "the change moved since the tick"; `apply` red with `outcome` `refused`, its result file's reason and the log line `<stack> was not deployed: the change moved since the tick.`; one comment that mentions the ticker, word for word; the row pending with a box, a new hash, `failed="true"` and the line `:x: last deploy failed: the change moved since the tick · ticked by <bot>`. After the tick, as record 0111 adds: `apply`'s log says `main moved on from <commit>, the commit this run checked out, to a commit that changes a file <stack> claims: <file>.` and that it started a full scan, it runs no fresh preview, the scan it dispatched writes the row, and the comment says a newer commit reached the branch before the deploy started. | Yes | 5 min |
+| 23 | A cancelled deploy, then "Re-run failed jobs" | Pu | A push of `pulumi/states/slow`, whose deploy sleeps for five minutes. The bot ticks it, and ten seconds after its record is `in_progress` the driver cancels the run. Then it calls "Re-run failed jobs" on that run. | After the cancel: the record ends `error`, "the run ended without a result"; `settle` logs that it ended the record, `Wrote the failure line on the row of <stack>, before the full scan previews it again (record 0113).` and that it started a full scan; the edit history holds `settle`'s row, `no preview since its deploy ended, the next scan previews it` with state `preview-failed`, `failed="true"`, no box and the failure line right under it, within 60 seconds of the cancel; the scan after it leaves `:x: last deploy failed: the run ended without a result · ticked by <bot>` and `failed="true"` on the row. After the re-run: no new record and no new status; attempt 2 of `apply` is red with `outcome` `refused` and logs `Deployment record N already ended as error. Nothing is deployed. A re-run never deploys (record 0019).` and `This deploy already ended. Tick the box on the dashboard to try again.`; `settle` logs that no record of the run is open; the row is as before. | Yes | 8 min |
 | 24 | The rescan box | Pu, Tofu | The bot ticks the rescan box. | The tick starts one `issues` run, whose `resolve` logs `The rescan box was ticked by <bot>.` and `Started a full scan for the rescan box`, and one `workflow_dispatch` run whose scan previews every stack. The box is clear after, no deployment record is made, and the commit still has one preview page per stack name. | Yes | 3 min |
 | 25 | A dashboard closed by hand | Pu, Tofu | The driver closes the dashboard with its label kept, then pushes a README change. | The next scan reopens the same number: one open issue with the label, still pinned, the log line `Reopened the dashboard and wrote it: <url> (`, and its rows. | No | 2 min |
 | 26 | Dashboard settings | Pu, Tofu | Three pushes of `sluiceway.yaml`: `dashboard.redact: true`, then `dashboard.personality: false` in its place, then neither. | With redact: no change line, and no type, name or changed path that the result file lists is on the dashboard; each pending row sends to the summary; the result file still has the changes. With personality off: no `<picture>`, no mascot file, no dot on the counts line or the trail. With neither: the picture and the change lines are back. | No | 4 min |
 | 27 | A body near the size limit | Tofu | A push of two OpenTofu stacks with 600 `random_id` each, so the full scan's body goes over 58,000 characters. | The body is at most 58,000 characters and its length is the number in the log line `Wrote the dashboard: <url> (N of 65,536 characters).` Only the two big rows are shortened, and the note says `so K of P pending rows are shortened`, as the markers count them, as does `K rows shortened to fit the size budget.` in the log. Each shortened row's preview link is its page, which lists all 600 changes, and each of its summary links is this scan's run, which GitHub answers. | No | 2 min |
 | 28 | No preview pages without `checks: write` | Pu, Tofu | A push of the workflow without `checks: write`, "Run workflow", then a push that puts it back. | The scan logs `No preview page was written: GitHub answered "…"` and that the links land on the summary of the scan. It writes no page, and every pending row's `preview` links the summary of that run. | No | 4 min |
 | 29 | A merged pull request on the row | Tofu | The bot opens a pull request that changes `opentofu/site/dev.tfvars`, of a stack deployed in 6, and merges it with a squash. | The row is pending, and its attribution line starts `from #N by <bot>` and ends with a compare link. | Yes | 3 min |
-| 30 | A hostile name stays plain text | Tofu | A resource of `opentofu/notes` named `#1 @sluiceway www.example.com *x*` through `for_each`. `@sluiceway` is the organisation that owns the test bed: GitHub links a mention only when the account exists, so a handle nobody holds would never show whether the name was escaped, and a mention of an organisation notifies no person. | The name is on the row with its `*` written as `&#42;`. In the issue body as GitHub renders it (`application/vnd.github.html+json`), and in the stack's preview page rendered through `POST /markdown` in the test bed's context, the name holds no issue link, no mention, no autolink and no emphasis. | No | 0, part of 1 |
+| 30 | A hostile name stays plain text | Tofu | A resource of `opentofu/notes` named `#1 @sluiceway www.example.com *x*` through `for_each`. `@sluiceway` is the organisation that owns the test bed: GitHub links a mention only when the account exists, so a handle nobody holds would never show whether the name was escaped, and a mention of an organisation notifies no person. | The name is on the row as record 0112 writes it: `<span>#</span>1 <span>@</span>sluiceway www&#46;example.com &#42;x&#42;`. In the issue body as GitHub renders it (`application/vnd.github.html+json`), and in the stack's preview page rendered through `POST /markdown` in the test bed's context, the name holds no issue link, no mention, no autolink and no emphasis. | No | 0, part of 1 |
 | 31 | Deploy on merge, and a replace waits | Pu | A push adds `pulumi/states/merge:prod` and `pulumi/states/values:prod`, both with `deploy: on-merge`. A second push lengthens the pet of `merge`, which replaces it, and puts `values` back on a tick. | After the first push, with no tick: one record per stack on the pushed commit, with `onMerge: true` and the sender of the push as `ticker`, ended `success`; the scan's `matrix` names both and `apply-merged` deploys each; both rows in sync; the edit history holds `deploying on merge · merged by <login>` with no box, and the trail `🟢 <stack> · merged by <login>` (record 0095). After the replace: no record, no `apply-merged`, the row pending with a box, `destroys` on its marker and the line `this stack deploys on merge, and this change waits for a tick: it deletes or replaces a resource.` | No | 4 min |
 | 32 | A value changed since the tick | Pu | `values:prod`, now on a tick, changes `environment.VALUE`, a path the row does not show. The scan of a push that changes it again is held, and the driver ticks the row as the scan before wrote it. | The row had a `fingerprint` next to its hash. One record, whose `hash` and `fingerprint` are the ticked row's, ended `error`, "a value changed since the tick"; `apply` red, `outcome` `refused`, its result file's reason and the log line `<stack> was not deployed: a value changed since the tick.`; one comment that mentions the ticker, word for word; the row pending with the **same** hash, a new fingerprint, `failed="true"` and its failure line (record 0102). | Yes | 4 min |
-| 33 | A tick outside the deploy window | Pu | A push gives `values:prod` a window of `stacks[].deployWindows` that opens about nine minutes later, today in UTC. The driver ticks the row before it opens, waits until it is open, then starts the workflow with "Run workflow". | The tick opens one record with `window: true` that stays open, starts no `apply`, and the row has no box and reads `queued for the deploy window, which opens <date> <time> UTC · ticked by <login>`. The dispatched `resolve` ends it `inactive`, "started in a later run", and opens a record with the same hash and ticker and no `window`, which `apply` deploys; the row is in sync (record 0104). The schedule starts the same `resolve`, and the test bed's `resolve` runs on it, but a cron cannot be timed to the minute, so the dispatch stands in. | Yes | 12 min |
+| 33 | A tick outside the deploy window | Pu | A push gives `values:prod` a window of `stacks[].deployWindows` that opens about nine minutes later and lasts an hour, in UTC; one that crosses midnight is written as two, to `24:00` and from `00:00`. The driver ticks the row before it opens, waits until it is open, then starts the workflow with "Run workflow". | The tick opens one record with `window: true` that stays open, starts no `apply`, and the row has no box and reads `queued for the deploy window, which opens <date> <time> UTC · ticked by <login>`. The dispatched `resolve` ends it `inactive`, "started in a later run", and opens a record with the same hash and ticker and no `window`, which `apply` deploys; the row is in sync (record 0104). The schedule starts the same `resolve`, and the test bed's `resolve` runs on it, but a cron cannot be timed to the minute, so the dispatch stands in. | Yes | 12 min |
 | 34 | The scan-running line | All | Nothing, reads the scan of the push in 2. | The edit history holds one body whose root marker has `scan-running` with the scan's run id and `scan-running-since` before that write, and the line `A scan is running since <time> UTC · [run](<run>)`; the body at the end has neither key nor line; the scan's log has `The dashboard says a scan is running, under the scan line, until this scan writes the body (record 0108): <run>`. | No | 0, part of 2 |
+| 35 | A tick inside a deploy freeze | Pu | A push adds `freezes` with one freeze that started a minute ago and ends about eight minutes later, with a reason. The driver ticks `greeting:dev` inside it, waits for its end, then starts the workflow with "Run workflow". | The dashboard names the freeze once: `Deploy freeze until <date> <time> UTC (<reason>): every deploy waits for it to end.` The tick opens one record with `window: true` that stays open, starts no `apply`, and the row is `queued`, with no box, and reads `queued for the end of the deploy freeze (<reason>) at <date> <time> UTC · ticked by <login>`. After the end the dispatched `resolve` ends it `inactive`, "started in a later run", and opens a record with the same hash and ticker and no `window`, which `apply` deploys; the row is in sync and the freeze line is gone (record 0115). | Yes | 12 min |
+| 36 | Layout keys keep the destroy lines | Pu, Tofu | A push sets `dashboard.pendingDetail: compact` and `dashboard.inSyncSection: off`, and takes the freeze of 35 out. A second push takes both keys out. | Against the body just before: every row is still there and its marker is the same but for `shortened`; a pending row shows only lines the full row had, no fold of changes and no attribution line, and keeps every `:warning: DELETE`, `:warning: REPLACE` and failure line; the in sync rows are whole inside `<details><summary>N stacks in sections this dashboard does not show</summary>`, with no In sync heading and no fold of ignored stacks, and the counts line still counts them; the destroy alert stays. After the second push the fold is gone, and the heading, the ignored stacks and the folds of changes are back (record 0114). | No | 4 min |
+| 37 | Counts on a pending row's marker | Pu, Tofu | Nothing, reads every step. | For every pending row the last scan of a step previewed: `creates`, `updates`, `replaces` and `tracking` on the marker are the numbers of the result file's changes and of the first line, each left out at 0, and `destroys` and `deletes` agree with them. Across the run at least one row has a create, an update, a replace and a delete (record 0110). `tracking` and `behind` are not met: no fixture moves a resource, and no scenario queues a stack behind another. | No | 0 |
 
 ### The leak check
 
diff --git a/release-verify/README.md b/release-verify/README.md
index 36e2d3a..d7c34d3 100644
--- a/release-verify/README.md
+++ b/release-verify/README.md
@@ -13,7 +13,7 @@ The driver, the fixtures and the scenarios that verify each release of Sluiceway
 | [`driver/bed.ts`](driver/bed.ts) | One step on the test bed (a push, a tick, a dispatch), the wait until it is quiet, and everything read back after it. |
 | [`driver/catalogue.ts`](driver/catalogue.ts) | The scenarios this harness runs, the adapters and the stacks of the fixtures. |
 | [`driver/check.ts`](driver/check.ts) | What a scenario found, per adapter. |
-| [`driver/scans.ts`](driver/scans.ts), [`ticks.ts`](driver/ticks.ts), [`signs.ts`](driver/signs.ts), [`results.ts`](driver/results.ts), [`names.ts`](driver/names.ts), [`settings.ts`](driver/settings.ts), [`moved.ts`](driver/moved.ts), [`size.ts`](driver/size.ts), [`cancel.ts`](driver/cancel.ts), [`attribution.ts`](driver/attribution.ts), [`pair.ts`](driver/pair.ts), [`merge.ts`](driver/merge.ts), [`state.ts`](driver/state.ts) | The assertions: scenarios 1 to 5, 6 and 7, 17 and 18, 19, 30, 24 to 26 and 28, 22, 27, 23, 29 and 21, 31 to 34, and the saved state of each deploy. |
+| [`driver/scans.ts`](driver/scans.ts), [`ticks.ts`](driver/ticks.ts), [`signs.ts`](driver/signs.ts), [`results.ts`](driver/results.ts), [`names.ts`](driver/names.ts), [`settings.ts`](driver/settings.ts), [`moved.ts`](driver/moved.ts), [`size.ts`](driver/size.ts), [`cancel.ts`](driver/cancel.ts), [`attribution.ts`](driver/attribution.ts), [`pair.ts`](driver/pair.ts), [`merge.ts`](driver/merge.ts), [`layout.ts`](driver/layout.ts), [`state.ts`](driver/state.ts) | The assertions: scenarios 1 to 5, 6 and 7, 17 and 18, 19, 30, 24 to 26 and 28, 22, 27, 23, 29 and 21, 31 to 34, 35 to 37, and the saved state of each deploy. |
 | [`driver/summary.ts`](driver/summary.ts) | The table of scenarios by adapter. |
 | [`fixtures/base/`](fixtures/base/) | The first commit of the test bed: the workflow with `{{SLUICEWAY_REF}}` for the tag, `sluiceway.yaml` and the stacks. |
 | `fixtures/<step>/` | An overlay one step lays over the test bed's files. `<file>.delete` takes a file out. |
@@ -30,6 +30,6 @@ Node 24 runs the driver as it is, with no install. Scenario 21, and the `admin`
 node release-verify/driver/main.ts
 ```
 
-Without `--version` it verifies `SLUICEWAY_VERSION` of `versions.json`; `--version v0.26.0` verifies another tag. It takes about 55 minutes, ten of them a wait for the deploy window of scenario 33 to open. The summary is printed at the end and written, with everything the driver read, to `release-verify/out/<version>-<time>/`, which git ignores. `--keep` leaves the test bed as the last step left it, to look at by hand; the next run's reset clears it. The exit code is 0 when every scenario passed.
+The test bed is shared: the driver first waits until the newest commit of its `main` ends in `: done`, and whatever happens it leaves a commit that does when it ends, unless `--keep` holds the test bed. It keeps the logs of every run of the test bed the moment the run ends, in `logs/` of its output. Without `--version` it verifies `SLUICEWAY_VERSION` of `versions.json`; `--version v0.26.0` verifies another tag. It takes about 70 minutes, twenty of them waits: for the deploy window of scenario 33 to open and for the deploy freeze of scenario 35 to end. The summary is printed at the end and written, with everything the driver read, to `release-verify/out/<version>-<time>/`, which git ignores. `--keep` leaves the test bed as the last step left it, to look at by hand; the next run's reset clears it. The exit code is 0 when every scenario passed.
 
 To check the types: `npx tsc -p release-verify/tsconfig.json`, after `npm ci` at the root.
diff --git a/release-verify/driver/bed.ts b/release-verify/driver/bed.ts
index e69f665..a7d9a4b 100644
--- a/release-verify/driver/bed.ts
+++ b/release-verify/driver/bed.ts
@@ -18,6 +18,7 @@ import {
   type Run,
   runLogs,
   startedAt,
+  type WaitOptions,
   waitQuiet,
 } from "./evidence.ts";
 import { changedPaths, commit, overlay, type Tree } from "./fixture.ts";
@@ -78,6 +79,8 @@ export class Bed {
   private tree: Tree = new Map();
   private head: string | null = null;
   private steps = 0;
+  // The runs whose logs were kept as they ended, by id and attempt.
+  private readonly saved = new Set<string>();
   private readonly github: GitHub;
   private readonly values: Record<string, string>;
   private readonly out: string;
@@ -104,7 +107,7 @@ export class Bed {
     this.log(`pushed ${sha.slice(0, 7)}: ${what} (${changed.length} file(s))`);
     this.tree = tree;
     this.head = sha;
-    await waitQuiet(this.github, { expect: (run) => run.event === "push" && run.head_sha === sha, since, log: this.log });
+    await this.quiet({ expect: (run) => run.event === "push" && run.head_sha === sha, since });
     return this.observe(what, since);
   }
 
@@ -129,7 +132,7 @@ export class Bed {
     } finally {
       await this.hold("apply", false);
     }
-    await waitQuiet(this.github, { expect: (run) => run.event === "issues", since, log: this.log });
+    await this.quiet({ expect: (run) => run.event === "issues", since });
     return this.observe(what, since);
   }
 
@@ -149,7 +152,7 @@ export class Bed {
     } finally {
       await this.hold("scan", false);
     }
-    await waitQuiet(this.github, { expect: (run) => run.event === "push", since, log: this.log });
+    await this.quiet({ expect: (run) => run.event === "push", since });
     return this.observe(what, since);
   }
 
@@ -174,7 +177,7 @@ export class Bed {
     const cancelledAt = new Date();
     await this.github.request("POST", repoPath(`/actions/runs/${run.id}/cancel`));
     this.log(`cancelled run ${run.id}`);
-    await waitQuiet(this.github, { expect: (r) => r.event === "workflow_dispatch", since: cancelledAt, timeoutMinutes: 8, log: this.log });
+    await this.quiet({ expect: (r) => r.event === "workflow_dispatch", since: cancelledAt, timeoutMinutes: 8 });
     return { observed: await this.observe(what, since), cancelledAt, runId: run.id };
   }
 
@@ -183,7 +186,7 @@ export class Bed {
     const since = new Date();
     await this.github.request("POST", repoPath(`/actions/runs/${runId}/rerun-failed-jobs`), {});
     this.log(`re-ran the failed jobs of run ${runId}`);
-    await waitQuiet(this.github, { expect: (r) => r.id === runId && r.run_attempt > 1, since, log: this.log });
+    await this.quiet({ expect: (r) => r.id === runId && r.run_attempt > 1, since });
     return this.observe(what, since);
   }
 
@@ -209,7 +212,7 @@ export class Bed {
     this.tree = tree;
     this.head = sha;
     await this.github.request("DELETE", repoPath(`/git/refs/heads/${branch}`), undefined, [404, 422]);
-    await waitQuiet(this.github, { expect: (r) => r.event === "push" && r.head_sha === sha, since, log: this.log });
+    await this.quiet({ expect: (r) => r.event === "push" && r.head_sha === sha, since });
     return { observed: await this.observe(what, since), number };
   }
 
@@ -223,7 +226,7 @@ export class Bed {
     if (!issue) throw new HarnessError("The second account sees no open dashboard.");
     await other.request("PATCH", repoPath(`/issues/${issue.number}`), { body: tickBox(issue.body, second) });
     this.log(`ticked ${second} as the second account`);
-    await waitQuiet(this.github, { expect: (r) => r.event === "issues", since, log: this.log });
+    await this.quiet({ expect: (r) => r.event === "issues", since });
     return this.observe(what, since);
   }
 
@@ -234,10 +237,26 @@ export class Bed {
     if (!issue) throw new HarnessError("The second account sees no open dashboard.");
     await other.request("PATCH", repoPath(`/issues/${issue.number}`), { body: tickBox(issue.body, stack) });
     this.log(`ticked ${stack} as the second account`);
-    await waitQuiet(this.github, { expect: (r) => r.event === "issues", since, log: this.log });
+    await this.quiet({ expect: (r) => r.event === "issues", since });
     return this.observe(what, since);
   }
 
+  // Waits until the test bed is quiet, and keeps the logs of every run the
+  // moment it is seen completed, in <out>/logs/<run>-<attempt>, before
+  // anything else can delete it.
+  private async quiet(options: Omit<WaitOptions, "ended" | "log">): Promise<Run[]> {
+    return waitQuiet(this.github, {
+      ...options,
+      log: this.log,
+      ended: async (run) => {
+        const key = `${run.id}-${run.run_attempt}`;
+        if (this.saved.has(key)) return;
+        this.saved.add(key);
+        await this.logsOf(run, this.out);
+      },
+    });
+  }
+
   // The branch release-verify-hold-<job> holds that job of the test bed's
   // workflow at its first step while it exists.
   private async hold(job: string, on: boolean): Promise<void> {
@@ -309,7 +328,7 @@ export class Bed {
     const since = new Date();
     await this.github.request("PATCH", repoPath(`/issues/${issue.number}`), { body });
     this.log(`ticked ${ticked}`);
-    await waitQuiet(this.github, { expect: (run) => run.event === "issues", since, log: this.log });
+    await this.quiet({ expect: (run) => run.event === "issues", since });
     return this.observe(what, since);
   }
 
@@ -328,7 +347,7 @@ export class Bed {
     const since = new Date();
     await this.github.request("POST", repoPath("/actions/workflows/deploy-dashboard.yml/dispatches"), { ref: "main" });
     this.log(`started the workflow: ${what}`);
-    await waitQuiet(this.github, { expect: (run) => run.event === "workflow_dispatch", since, log: this.log });
+    await this.quiet({ expect: (run) => run.event === "workflow_dispatch", since });
     return this.observe(what, since);
   }
 
diff --git a/release-verify/driver/cancel.ts b/release-verify/driver/cancel.ts
index c581241..16b2bf7 100644
--- a/release-verify/driver/cancel.ts
+++ b/release-verify/driver/cancel.ts
@@ -1,14 +1,17 @@
 // Scenario 23: a deploy cancelled while it runs, then "Re-run failed jobs"
 // on that run. The cancel ends the record as "the run ended without a
-// result", and settle's scan puts the failure line on the row within a
-// minute (acceptance item 10). The re-run deploys nothing and says to tick
+// result", and the failure line is on the row within a minute (acceptance
+// item 10). Since v0.42.2 settle writes it itself, with no tool, before the
+// full scan it starts previews the stack again (record 0113). The re-run deploys nothing and says to tick
 // again (item 11, record 0019).
 import type { Deployment, Observed } from "./bed.ts";
 import { Check, type Outcome } from "./check.ts";
-import { jobLogs } from "./evidence.ts";
+import { jobLogs, parseDashboard } from "./evidence.ts";
 import { runUrls } from "./scans.ts";
 
 const ENDED = "the run ended without a result";
+// The words of the row settle writes for a deploy it ended (record 0113).
+const SETTLED = "no preview since its deploy ended, the next scan previews it";
 
 const recordOf = (o: Observed, since: Date, stack: string): Deployment | undefined =>
   o.deployments.find((d) => d.task === `sluiceway:${stack}` && Date.parse(d.created_at) >= since.getTime() - 5_000);
@@ -30,6 +33,21 @@ export function scenario23Cancel(o: Observed, since: Date, cancelledAt: Date, ru
   check.expect(settle?.includes(ended) === true, `expected "${ended}" in the log of settle`);
   check.expect(settle?.includes("Started a full scan") === true, 'expected "Started a full scan" in the log of settle');
   check.expect(o.runs.some((r) => r.event === "workflow_dispatch"), "expected the full scan settle started");
+  const wrote = `Wrote the failure line on the row of ${stack}, before the full scan previews it again (record 0113).`;
+  check.expect(settle?.includes(wrote) === true, `expected "${wrote}" in the log of settle`);
+
+  // The row settle wrote, before the scan: no box, no diff, the failure line
+  // right under its first line.
+  const settledEdit = o.edits.find((edit) => parseDashboard(edit.body).rows.get(stack)?.firstLine.includes(SETTLED));
+  const settled = settledEdit ? parseDashboard(settledEdit.body).rows.get(stack) : undefined;
+  check.expect(settled !== undefined, `expected a revision of the body where the row of ${stack} says "${SETTLED}"`);
+  if (settled) {
+    check.equal([settled.state, settled.attributes.failed, settled.hasBox], ["preview-failed", "true", false], `state, failed and box of the row settle wrote for ${stack}`);
+    check.expect(
+      (settled.block.split("\n")[1] ?? "").startsWith(`  :x: last deploy failed: ${ENDED} · ticked by ${login} · `),
+      `expected the failure line right under the first line of the row settle wrote, found: ${settled.block}`,
+    );
+  }
 
   // The row has the failure line, and it came within a minute.
   const line = `:x: last deploy failed: ${ENDED} · ticked by ${login} · `;
diff --git a/release-verify/driver/catalogue.ts b/release-verify/driver/catalogue.ts
index f4022d2..8472cff 100644
--- a/release-verify/driver/catalogue.ts
+++ b/release-verify/driver/catalogue.ts
@@ -30,6 +30,9 @@ export const SCENARIOS: Record<number, string> = {
   32: "A value changed since the tick",
   33: "A tick outside the deploy window",
   34: "The scan-running line",
+  35: "A tick inside a deploy freeze",
+  36: "Layout keys keep the destroy lines",
+  37: "Counts on a pending row's marker",
 };
 
 // The stacks of the base fixtures, by adapter. The scratch stack is ignored.
diff --git a/release-verify/driver/evidence.ts b/release-verify/driver/evidence.ts
index f901edb..5aaf95b 100644
--- a/release-verify/driver/evidence.ts
+++ b/release-verify/driver/evidence.ts
@@ -36,6 +36,9 @@ export interface WaitOptions {
   since: Date;
   timeoutMinutes?: number;
   log?: (line: string) => void;
+  // Called once for each run as soon as it is seen completed, so its logs
+  // can be kept before anything else touches the test bed.
+  ended?: (run: Run) => Promise<void>;
 }
 
 // Waits for the runs a step started, and for every run they started in turn,
@@ -48,6 +51,7 @@ export async function waitQuiet(github: GitHub, options: WaitOptions): Promise<R
   let lastLine = "";
   for (;;) {
     const runs = (await listRuns(github)).filter((run) => startedAt(run) >= since);
+    if (options.ended) for (const run of runs.filter((r) => r.status === "completed")) await options.ended(run);
     const started = runs.some(options.expect);
     const open = runs.filter((run) => run.status !== "completed");
     quietReads = started && open.length === 0 ? quietReads + 1 : 0;
diff --git a/release-verify/driver/layout.ts b/release-verify/driver/layout.ts
new file mode 100644
index 0000000..6dfc555
--- /dev/null
+++ b/release-verify/driver/layout.ts
@@ -0,0 +1,214 @@
+// Scenarios 35 to 37, for what v0.42 to v0.44 added:
+//
+// - 35 a deploy freeze (record 0115): a tick inside it waits, its row names
+//   the freeze and its reason, the dashboard names the freeze under the scan
+//   line, and a run after its end starts the deploy.
+// - 36 the layout keys (record 0114): at `pendingDetail: compact` with
+//   `inSyncSection: off` a pending row keeps its delete, replace and failure
+//   lines, the in sync rows move whole into the fold of sections that are
+//   off, and every marker is the one the full layout wrote.
+// - 37 the counts on a pending row's marker (record 0110): `creates`,
+//   `updates`, `replaces` and `tracking` are the numbers of the first line
+//   and of the scan's result file, and `deletes` with them.
+import { keptOf, type Observed } from "./bed.ts";
+import { ADAPTERS } from "./catalogue.ts";
+import { Check, type Outcome } from "./check.ts";
+import { count, type Row } from "./evidence.ts";
+import { startedLater } from "./merge.ts";
+import { runUrls } from "./scans.ts";
+import { madeIn, payloadOf } from "./ticks.ts";
+
+export const FREEZE_REASON = "Release verification freeze";
+export const FREEZE_STACK = "pulumi/plain/greeting:dev";
+
+// A time as the dashboard writes one that stands alone, in UTC, which the
+// test bed's dashboard zone is: "2026-09-25 23:10 UTC".
+export const utcMinute = (d: Date): string => `${d.toISOString().slice(0, 10)} ${d.toISOString().slice(11, 16)} UTC`;
+
+const freezeLine = (ends: Date) => `Deploy freeze until ${utcMinute(ends)} (${FREEZE_REASON}): every deploy waits for it to end.`;
+
+// 35, the push that adds the freeze: the dashboard names it once.
+export function scenario35Line(o: Observed, ends: Date): Outcome[] {
+  const check = new Check(35, ["Pu"]);
+  const body = o.issues[0]?.body ?? "";
+  const line = freezeLine(ends);
+  check.equal(body.split(line).length - 1, 1, `lines "${line}" on the dashboard`);
+  return check.outcomes(runUrls(o));
+}
+
+// 35, a tick inside the freeze: its record waits with window, nothing is
+// handed on, and the row names the freeze, its reason and its end.
+export function scenario35Waiting(o: Observed, since: Date, stack: string, login: string, ends: Date): Outcome[] {
+  const check = new Check(35, ["Pu"]);
+  const made = madeIn(o, since);
+  check.equal(made.map((d) => d.task), [`sluiceway:${stack}`], "the deployment records the tick inside the freeze made");
+  const record = made[0];
+  check.equal(record ? payloadOf(record).window : undefined, true, "window on the record that waits for the end of the freeze");
+  check.expect(
+    !["success", "error", "failure", "inactive"].includes(record?.statuses[0]?.state ?? ""),
+    `expected the record open while the freeze holds, found ${record?.statuses[0]?.state}: ${record?.statuses[0]?.description}`,
+  );
+  check.equal(keptOf(o, "apply").length, 0, "apply jobs while the freeze holds");
+  const row = o.dashboard?.rows.get(stack);
+  check.equal(row?.state, "queued", `the state of ${stack} while it waits for the end of the freeze`);
+  check.expect(row?.hasBox === false, `expected no box on ${stack} while it waits`);
+  const words = `queued for the end of the deploy freeze (${FREEZE_REASON}) at ${utcMinute(ends)} · ticked by ${login}`;
+  check.expect(row?.firstLine.includes(words) === true, `expected "${words}" on ${stack}, found: ${row?.firstLine}`);
+  check.expect((o.issues[0]?.body ?? "").includes(freezeLine(ends)), `expected "${freezeLine(ends)}" on the dashboard while the freeze holds`);
+  return check.outcomes(runUrls(o));
+}
+
+// 35, "Run workflow" after the freeze ended: resolve starts the record that
+// waited in one of its own, apply deploys it, and the freeze line is gone.
+export function scenario35Started(waitedId: number | undefined, o: Observed, since: Date, stack: string, login: string): Outcome[] {
+  const check = new Check(35, ["Pu"]);
+  startedLater(check, waitedId, o, since, stack, login, "the freeze ended");
+  const body = o.issues[0]?.body ?? "";
+  check.expect(!body.includes("Deploy freeze "), "expected no freeze line on the dashboard after the freeze ended");
+  return check.outcomes(runUrls(o));
+}
+
+// The lines under a row's first line.
+const under = (row: Row | undefined): string[] => (row?.block.split("\n") ?? []).slice(1).filter((line) => !line.includes("<!-- /sluiceway:row -->"));
+const destroyLines = (row: Row | undefined): string[] => under(row).filter((line) => /^\s*:warning: <kbd>(DELETE|REPLACE)<\/kbd>/.test(line));
+const failureLines = (row: Row | undefined): string[] => under(row).filter((line) => line.includes(":x: last deploy failed:"));
+// The marker's keys without `shortened`, which follows what the size budget
+// chose under the layout (record 0114).
+const marker = (row: Row | undefined): Record<string, string> => {
+  const { shortened: _, ...rest } = row?.attributes ?? {};
+  return rest;
+};
+
+export const OFF_FOLD = /<details><summary>(\d+) stacks? in sections this dashboard does not show<\/summary>([\s\S]*?)<\/details>/;
+
+// 36, compact rows and In sync off, against the dashboard just before with
+// the full layout.
+export function scenario36Compact(before: Observed, o: Observed): Outcome[] {
+  const check = new Check(36, ADAPTERS);
+  const body = o.issues[0]?.body ?? "";
+  const was = before.dashboard?.rows ?? new Map<string, Row>();
+  const now = o.dashboard?.rows ?? new Map<string, Row>();
+  check.equal([...now.keys()].sort(), [...was.keys()].sort(), "the rows on the dashboard, which no layout key drops");
+
+  let destroying = 0;
+  for (const [stack, row] of now) {
+    const old = was.get(stack);
+    check.equal(marker(row), marker(old), `the marker of ${stack}, the same at every layout`, stack);
+    if (row.state !== "pending") continue;
+    const kept = under(row);
+    const full = under(old);
+    for (const line of kept) {
+      check.expect(full.includes(line), `${stack}: a line at compact the full row did not have: ${line}`, stack);
+    }
+    check.expect(!row.block.includes("<details>"), `${stack}: expected no fold of changes on a compact row, found: ${row.block}`, stack);
+    check.expect(!kept.some((line) => /^\s*from /.test(line)), `${stack}: expected no attribution line on a compact row`, stack);
+    check.equal(destroyLines(row), destroyLines(old), `the delete and replace lines of ${stack} at compact`, stack);
+    check.equal(failureLines(row), failureLines(old), `the failure line of ${stack} at compact`, stack);
+    if (destroyLines(old).length > 0) destroying++;
+  }
+  check.expect(destroying > 0, "expected a pending row with delete or replace lines to look at");
+
+  // In sync off: its heading and its fold of ignored stacks go, and its rows
+  // move whole into the one fold at the end of the sections.
+  const quiet = [...was.values()].filter((row) => row.state === "in-sync" && row.attributes.failed !== "true");
+  check.expect(quiet.length > 0, "expected in sync rows to move into the fold of sections that are off");
+  const fold = OFF_FOLD.exec(body);
+  check.equal(Number(fold?.[1]), quiet.length, "the stacks the fold of sections that are off counts");
+  for (const row of quiet) {
+    const moved = now.get(row.stack);
+    check.expect(moved !== undefined && (fold?.[2] ?? "").includes(moved.block), `expected the row of ${row.stack} whole in the fold of sections that are off`, row.stack);
+  }
+  check.expect(!/^## In sync$/m.test(body), "expected no In sync heading with inSyncSection: off");
+  check.equal(o.dashboard?.ignored.size, 0, "stacks in the fold of ignored stacks, which In sync off leaves out");
+  check.equal(count(o.dashboard?.countsLine ?? "", "in sync"), count(before.dashboard?.countsLine ?? "", "in sync"), "in sync on the counts line, which still counts the rows that are off");
+  check.expect(/> \[!CAUTION\]/.test(body), "expected the destroy alert, which no layout key hides");
+  return check.outcomes(runUrls(o));
+}
+
+// 36, the layout keys taken out: the dashboard is drawn as before.
+export function scenario36Back(before: Observed, o: Observed): Outcome[] {
+  const check = new Check(36, ADAPTERS);
+  const body = o.issues[0]?.body ?? "";
+  check.expect(!OFF_FOLD.test(body), "expected no fold of sections that are off once the keys are taken out");
+  check.expect(/^## In sync$/m.test(body), "expected the In sync heading back");
+  check.equal([...(o.dashboard?.ignored.keys() ?? [])], [...(before.dashboard?.ignored.keys() ?? [])], "the fold of ignored stacks, back");
+  for (const [stack, old] of before.dashboard?.rows ?? []) {
+    const row = o.dashboard?.rows.get(stack);
+    if (old.state !== "pending") continue;
+    check.equal(destroyLines(row), destroyLines(old), `the delete and replace lines of ${stack}, back at full`, stack);
+    check.equal(row?.block.includes("<details>"), old.block.includes("<details>"), `a fold of changes on ${stack}, back at full`, stack);
+  }
+  return check.outcomes(runUrls(o));
+}
+
+interface ResultChange {
+  op: string;
+  tracking?: string;
+}
+
+// 37: every pending row a scan of a step wrote carries on its marker the
+// counts of its first line, and they are the scan's own counts of its diff.
+// Reads every step. `seen` collects which counts were not 0 somewhere, so a
+// run that never met a create, an update, a replace or a delete says so.
+export function scenario37(observed: Observed[]): Outcome[] {
+  const check = new Check(37, ADAPTERS);
+  const seen = new Set<string>();
+  let rows = 0;
+  for (const o of observed) {
+    const scans = keptOf(o, "scan");
+    const last = scans.at(-1);
+    const stacks = (last?.result as { stacks?: { stack: string; state: string; changes?: ResultChange[] }[] } | null)?.stacks ?? [];
+    for (const entry of stacks) {
+      const row = o.dashboard?.rows.get(entry.stack);
+      if (entry.state !== "pending" || row?.state !== "pending") continue;
+      rows++;
+      const changes = entry.changes ?? [];
+      const of = (op: string) => changes.filter((c) => c.op === op).length;
+      const expected = {
+        creates: of("create"),
+        updates: of("update"),
+        replaces: of("replace"),
+        deletes: of("delete"),
+        tracking: changes.filter((c) => c.op === "none" && c.tracking !== undefined).length,
+      };
+      const a = row.attributes;
+      const onMarker = {
+        creates: Number(a.creates ?? 0),
+        updates: Number(a.updates ?? 0),
+        replaces: Number(a.replaces ?? 0),
+        deletes: Number(a.deletes ?? 0),
+        tracking: Number(a.tracking ?? 0),
+      };
+      const where = `${o.what}: ${entry.stack}`;
+      check.equal(onMarker, expected, `${where}: the counts on the marker against the result file`, entry.stack);
+      // A count of 0 is left out, apart from deletes, which is written
+      // whenever destroys is, 0 included.
+      for (const key of ["creates", "updates", "replaces", "tracking"] as const) {
+        if (expected[key] === 0) check.expect(a[key] === undefined, `${where}: expected no ${key} on the marker at 0, found ${a[key]}`, entry.stack);
+        else seen.add(key);
+      }
+      const destroys = expected.replaces + expected.deletes;
+      if (destroys > 0) {
+        if (expected.deletes > 0) seen.add("deletes");
+        check.equal([a.destroys, a.deletes], [String(destroys), String(expected.deletes)], `${where}: destroys and deletes on the marker`, entry.stack);
+      }
+      // The first line says the same numbers.
+      const words: [keyof typeof expected, RegExp][] = [
+        ["creates", /(\d+) creates?\b/],
+        ["updates", /(\d+) updates?\b/],
+        ["replaces", /(\d+) replaces?\b/],
+        ["deletes", /(\d+) deletes?\b/],
+        ["tracking", /(\d+) tracking only/],
+      ];
+      const first = row.firstLine.replace(/<!--.*-->/, "");
+      for (const [key, pattern] of words) {
+        check.equal(Number(pattern.exec(first)?.[1] ?? 0), expected[key], `${where}: ${key} on the first line`, entry.stack);
+      }
+    }
+  }
+  check.expect(rows > 0, "expected pending rows to read");
+  for (const key of ["creates", "updates", "replaces", "deletes"]) {
+    check.expect(seen.has(key), `expected at least one pending row with ${key} in the run`);
+  }
+  return check.outcomes([]);
+}
diff --git a/release-verify/driver/main.ts b/release-verify/driver/main.ts
index ab6f33f..c7618c0 100644
--- a/release-verify/driver/main.ts
+++ b/release-verify/driver/main.ts
@@ -15,7 +15,7 @@ import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { commit, quietTree, RELEASE_VERIFY } from "./fixture.ts";
-import { ACTION_REPO, findToken, GitHub, repoPath } from "./github.ts";
+import { ACTION_REPO, findToken, GitHub, repoPath, sleep } from "./github.ts";
 import { cleanup, reset } from "./reset.ts";
 import { Verification } from "./verify.ts";
 import { summarize } from "./summary.ts";
@@ -49,39 +49,60 @@ log(`verifying ${ACTION_REPO}@${version} (${tagCommit.slice(0, 7)}), output in $
 
 const values = { ...versions, SLUICEWAY_REF: version };
 
+// The test bed is shared: a verification that holds it leaves a head whose
+// message does not end in ": done" until it ends. Wait for that, at most
+// three hours, before the reset takes it over.
+for (let waited = 0; ; waited++) {
+  const head = await github.get<{ commit: { message: string } }>(repoPath("/commits/main"));
+  const subject = head.commit.message.split("\n")[0] ?? "";
+  if (subject.endsWith(": done")) break;
+  if (waited >= 180) {
+    console.error(`The test bed is still held after three hours: its head says "${subject}".`);
+    process.exit(2);
+  }
+  if (waited === 0) log(`the test bed is held ("${subject}"), waiting for a head that ends in ": done"`);
+  await sleep(60_000);
+}
+
 log("resetting the test bed");
 await reset(github, log);
 
 const verification = new Verification(github, values, out, log);
-await verification.run();
-
-const head = await github.get<{ object: { sha: string } }>(repoPath("/git/ref/heads/main"));
-const { markdown, result } = summarize(
-  {
-    version,
-    tagCommit,
-    fixtureCommit: head.object.sha,
-    started,
-    ended: new Date(),
-    versions: { Pulumi: versions.PULUMI_VERSION ?? "", OpenTofu: versions.TOFU_VERSION ?? "" },
-    local,
-  },
-  verification.outcomes,
-);
-writeFileSync(join(out, "summary.md"), markdown);
-writeFileSync(join(out, "outcomes.json"), JSON.stringify(verification.outcomes, null, 2));
-if (process.env.GITHUB_STEP_SUMMARY) appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown);
-console.log(`\n${markdown}`);
+let result = "failed";
+try {
+  await verification.run();
 
-if (args.keep) {
-  log("--keep: the test bed stays as the last step left it");
-} else {
-  log("cleaning up");
-  await cleanup(github, log);
-  // Until the summary issue exists, the README of the quiet test bed links
-  // to the driver.
-  const summaryUrl = "https://github.com/sluiceway/examples/tree/main/release-verify";
-  await commit(github, quietTree({ ...values, SUMMARY_URL: summaryUrl }), `Release verification of ${version}: done`, null);
+  const head = await github.get<{ object: { sha: string } }>(repoPath("/git/ref/heads/main"));
+  const summary = summarize(
+    {
+      version,
+      tagCommit,
+      fixtureCommit: head.object.sha,
+      started,
+      ended: new Date(),
+      versions: { Pulumi: versions.PULUMI_VERSION ?? "", OpenTofu: versions.TOFU_VERSION ?? "" },
+      local,
+    },
+    verification.outcomes,
+  );
+  result = summary.result;
+  writeFileSync(join(out, "summary.md"), summary.markdown);
+  writeFileSync(join(out, "outcomes.json"), JSON.stringify(verification.outcomes, null, 2));
+  if (process.env.GITHUB_STEP_SUMMARY) appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary.markdown);
+  console.log(`\n${summary.markdown}`);
+} finally {
+  // Whatever happened, the test bed is handed back with a head that ends in
+  // ": done", so the next verification does not wait for it.
+  if (args.keep) {
+    log("--keep: the test bed stays as the last step left it");
+  } else {
+    log("cleaning up");
+    await cleanup(github, log);
+    // Until the summary issue exists, the README of the quiet test bed links
+    // to the driver.
+    const summaryUrl = "https://github.com/sluiceway/examples/tree/main/release-verify";
+    await commit(github, quietTree({ ...values, SUMMARY_URL: summaryUrl }), `Release verification of ${version}: done`, null);
+  }
 }
 log(`${github.requests} requests to the GitHub API`);
 process.exit(result === "passed" ? 0 : 1);
diff --git a/release-verify/driver/merge.ts b/release-verify/driver/merge.ts
index 155100f..6a33103 100644
--- a/release-verify/driver/merge.ts
+++ b/release-verify/driver/merge.ts
@@ -176,14 +176,23 @@ export function scenario33Waiting(o: Observed, since: Date, stack: string, login
 // ends as started in a later run.
 export function scenario33Started(waitedId: number | undefined, o: Observed, since: Date, stack: string, login: string): Outcome[] {
   const check = new Check(33, ["Pu"]);
+  startedLater(check, waitedId, o, since, stack, login, "the window opened");
+  return check.outcomes(runUrls(o));
+}
+
+// A record that waited for a time, a window (33) or the end of a freeze (35),
+// started by a run once the time came: it ends as started in a later run, a
+// record of its own with the same hash and ticker and no window deploys, and
+// the row is in sync.
+export function startedLater(check: Check, waitedId: number | undefined, o: Observed, since: Date, stack: string, login: string, when: string): void {
   const waited = o.deployments.find((d) => d.id === waitedId);
   check.equal(
     [waited?.statuses[0]?.state, waited?.statuses[0]?.description],
     ["inactive", "started in a later run"],
-    "the last status of the record that waited for the window",
+    "the last status of the record that waited",
   );
   const made = madeIn(o, since);
-  check.equal(made.map((d) => d.task), [`sluiceway:${stack}`], "the deployment records the run inside the window made");
+  check.equal(made.map((d) => d.task), [`sluiceway:${stack}`], `the deployment records the run after ${when} made`);
   const record = made[0];
   const payload = record ? payloadOf(record) : {};
   check.equal(payload.window, undefined, "window on the record that started");
@@ -191,9 +200,8 @@ export function scenario33Started(waitedId: number | undefined, o: Observed, sin
   check.equal(payload.hash, waited ? payloadOf(waited).hash : undefined, "the diff hash on the record that started, the one the tick approved");
   check.equal(record?.statuses[0]?.state, "success", "the last status of the record that started");
   const apply = keptOf(o, "apply")[0];
-  check.equal([apply?.outcome, apply?.outputs.outcome, apply?.outputs.stack], ["success", "deployed", stack], "apply in the run inside the window");
-  check.equal(o.dashboard?.rows.get(stack)?.state, "in-sync", `the state of ${stack} after the window opened`);
-  return check.outcomes(runUrls(o));
+  check.equal([apply?.outcome, apply?.outputs.outcome, apply?.outputs.stack], ["success", "deployed", stack], `apply in the run after ${when}`);
+  check.equal(o.dashboard?.rows.get(stack)?.state, "in-sync", `the state of ${stack} after ${when}`);
 }
 
 // 34: during the scan of a push the body said a scan is running, from the
diff --git a/release-verify/driver/moved.ts b/release-verify/driver/moved.ts
index 980cae8..8c08a5e 100644
--- a/release-verify/driver/moved.ts
+++ b/release-verify/driver/moved.ts
@@ -7,6 +7,11 @@
 //   starts, as a merge that lands between a tick and its deploy;
 // - a stale row: the tick lands on a row whose commit is no longer the head,
 //   because the scan of the newer push is held.
+//
+// After the tick, since v0.42.2 (record 0111): `apply` compares the commit
+// it checked out with the head of its branch before the fresh preview,
+// refuses without running the tool, starts a full scan that writes the row,
+// and tells the ticker a newer commit reached the branch.
 import { keptOf, type Observed } from "./bed.ts";
 import { Check, type Outcome } from "./check.ts";
 import { jobLogs } from "./evidence.ts";
@@ -14,6 +19,9 @@ import { runUrls } from "./scans.ts";
 
 const MOVED = "the change moved since the tick";
 
+// The file the push after the tick changes, which the stack claims.
+const PROGRAM = "pulumi/plain/greeting/Pulumi.yaml";
+
 export function scenario22(
   when: string,
   before: Observed,
@@ -46,18 +54,34 @@ export function scenario22(
   check.equal(apply?.outputs.outcome, "refused", `${when}: the output outcome of apply`);
   check.equal((apply?.result as { reason?: string } | null)?.reason, MOVED, `${when}: reason in apply's result file`);
   const logs = apply ? o.logs.get(apply.run.id) : undefined;
+  const applyLog = logs ? jobLogs(logs, "apply").join("\n") : "";
   const line = `${stack} was not deployed: ${MOVED}.`;
-  check.expect(
-    logs !== undefined && jobLogs(logs, "apply").some((log) => log.includes(line)),
-    `${when}: expected "${line}" in the log of apply`,
-  );
+  check.expect(applyLog.includes(line), `${when}: expected "${line}" in the log of apply`);
+
+  // After the tick the refusal comes from the comparison with the branch
+  // (record 0111): the tool never ran, and apply started the full scan.
+  const afterTick = when === "after the tick";
+  if (afterTick) {
+    const moved =
+      /main moved on from [0-9a-f]{7}, the commit this run checked out, to a commit that changes a file /.test(applyLog) &&
+      applyLog.includes(`${stack} claims: ${PROGRAM}.`);
+    check.expect(moved, `${when}: expected "main moved on from <commit>, the commit this run checked out, to a commit that changes a file ${stack} claims: ${PROGRAM}." in the log of apply`);
+    check.expect(!applyLog.includes("The fresh preview gives diff hash"), `${when}: apply ran a fresh preview, which record 0111 says it skips`);
+    check.expect(
+      applyLog.includes("A full scan was started, which shows the change as it is now on the row."),
+      `${when}: expected "A full scan was started, which shows the change as it is now on the row." in the log of apply`,
+    );
+    check.expect(o.runs.some((r) => r.event === "workflow_dispatch"), `${when}: expected the full scan apply started`);
+  }
 
   // One comment that mentions the ticker.
   const comments = o.comments.filter((c) => Date.parse(c.created_at) >= since.getTime() - 5_000);
   check.equal(
     comments.map((c) => c.body.trim()),
     [
-      `@${login} ticked **${stack}**, and ${MOVED}, so nothing was deployed. The row on the dashboard shows the change as it is now. Tick it again to deploy that.`,
+      afterTick
+        ? `@${login} ticked **${stack}**, and a newer commit reached the branch before the deploy started, so nothing was deployed. The next scan shows the change as it is now on its row. Tick it again to deploy that.`
+        : `@${login} ticked **${stack}**, and ${MOVED}, so nothing was deployed. The row on the dashboard shows the change as it is now. Tick it again to deploy that.`,
     ],
     `${when}: the comments on the dashboard`,
   );
diff --git a/release-verify/driver/names.ts b/release-verify/driver/names.ts
index 26967d7..2bd8c95 100644
--- a/release-verify/driver/names.ts
+++ b/release-verify/driver/names.ts
@@ -1,9 +1,9 @@
 // Scenario 30: a resource name that GitHub turns into links when it reaches
 // a page as it is, "#1 @sluiceway www.example.com *x*", stays plain text on
 // the dashboard and on the stack's preview page. It reads what GitHub
-// renders, not only the Markdown: the escaping writes `*` as a reference, but
-// nothing in it stops an issue reference, a mention or an autolink
-// (`src/render/escape.ts`, `docs/later.md`, "Stopping GitHub from linking").
+// renders, not only the Markdown. Since v0.42.2 the escaping puts `#` and `@`
+// in a span and writes the dot of `www.` as a reference (record 0112), and
+// before it wrote only `*` as one (`src/render/escape.ts`).
 import type { Observed } from "./bed.ts";
 import { HOSTILE_STACK } from "./catalogue.ts";
 import { Check, type Outcome } from "./check.ts";
@@ -38,9 +38,10 @@ function linked(check: Check, html: string | undefined, where: string): void {
 export function scenario30(o: Observed, pageHtml: string | undefined): Outcome[] {
   const check = new Check(30, ["Tofu"]);
   const row = o.dashboard?.rows.get(HOSTILE_STACK);
+  const escaped = "<span>#</span>1 <span>@</span>sluiceway www&#46;example.com &#42;x&#42;";
   check.expect(
-    row?.block.includes("#1 @sluiceway www.example.com &#42;x&#42;") === true,
-    `expected the name on the row of ${HOSTILE_STACK}, with its * written as &#42;`,
+    row?.block.includes(escaped) === true,
+    `expected the name on the row of ${HOSTILE_STACK} as record 0112 escapes it, "${escaped}", found: ${row?.block}`,
   );
   linked(check, o.html, "dashboard");
   linked(check, pageHtml, `preview page of ${HOSTILE_STACK}`);
diff --git a/release-verify/driver/settings.ts b/release-verify/driver/settings.ts
index 8436246..259b338 100644
--- a/release-verify/driver/settings.ts
+++ b/release-verify/driver/settings.ts
@@ -61,15 +61,20 @@ export function scenario25(o: Observed, closed: number, pinned: number[]): Outco
   return check.outcomes(runUrls(o));
 }
 
-// The escaping of src/render/escape.ts, for names in the body.
+// The escaping of src/render/escape.ts, for names in the body, with the
+// rules of record 0112 for `#`, `@`, `www.`, `://` and `GH-`.
+const NAMED: Record<string, string> = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" };
 function escapeText(text: string): string {
   return text
     .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ")
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/[*_`~[\]|\\]/g, (c) => `&#${c.charCodeAt(0)};`);
+    .replace(/www\.|:\/\/|gh-(?=\d)|[&<>"*_`~[\]|\\#@]/gi, (c) => {
+      if (NAMED[c] !== undefined) return NAMED[c];
+      if (c === "#" || c === "@") return `<span>${c}</span>`;
+      if (c === "://") return "&#58;//";
+      if (c.toLowerCase() === "www.") return `${c.slice(0, 3)}&#46;`;
+      if (c.toLowerCase() === "gh-") return `${c.slice(0, 2)}<span>-</span>`;
+      return `&#${c.charCodeAt(0)};`;
+    });
 }
 
 // Scenario 26, first part: with dashboard.redact no type, name or property
diff --git a/release-verify/driver/verify.ts b/release-verify/driver/verify.ts
index d1665c1..91117e9 100644
--- a/release-verify/driver/verify.ts
+++ b/release-verify/driver/verify.ts
@@ -46,6 +46,7 @@ import {
   scenario34,
   VALUES_STACK,
 } from "./merge.ts";
+import { FREEZE_REASON, FREEZE_STACK, scenario35Line, scenario35Started, scenario35Waiting, scenario36Back, scenario36Compact, scenario37 } from "./layout.ts";
 import { scenario22 } from "./moved.ts";
 import { scenario30 } from "./names.ts";
 import { scenario21 } from "./pair.ts";
@@ -174,15 +175,18 @@ export class Verification {
 
     // 33: a window that opens a few minutes from now, a tick before it opens,
     // then "Run workflow" once it is open. The schedule starts the same
-    // resolve; a run a cron starts cannot be timed to the minute.
+    // resolve; a run a cron starts cannot be timed to the minute. A window
+    // of an hour that crosses midnight UTC is two: to 24:00 on the day it
+    // opens, and from 00:00 on the next.
     const opens = new Date(Math.ceil((Date.now() + 9 * 60_000) / 60_000) * 60_000);
-    if (opens.getUTCHours() >= 23 || opens.getUTCDate() !== new Date().getUTCDate()) {
-      this.mark([33], ["Pu"], "skipped", "the window would open too close to midnight UTC for one window of the day");
-      return;
-    }
+    const closes = new Date(opens.getTime() + 60 * 60_000);
     const hhmm = (d: Date) => d.toISOString().slice(11, 16);
-    const day = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"][opens.getUTCDay()];
-    const window = `    deployWindows:\n      - days: [${day}]\n        from: "${hhmm(opens)}"\n        to: "${hhmm(new Date(opens.getTime() + 60 * 60_000))}"\n`;
+    const dayOf = (d: Date) => ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"][d.getUTCDay()];
+    const entry = (d: Date, from: string, to: string) => `      - days: [${dayOf(d)}]\n        from: "${from}"\n        to: "${to}"\n`;
+    const window =
+      closes.getUTCDate() === opens.getUTCDate()
+        ? `    deployWindows:\n${entry(opens, hhmm(opens), hhmm(closes))}`
+        : `    deployWindows:\n${entry(opens, hhmm(opens), "24:00")}${hhmm(closes) === "00:00" ? "" : entry(closes, "00:00", hhmm(closes))}`;
     const windowed = await this.step([33], ["Pu"], () => this.bed.pushEdit(`a deploy window from ${hhmm(opens)} UTC on ${VALUES_STACK}`, entries(window)));
     if (!windowed) return;
     since = new Date();
@@ -201,6 +205,65 @@ export class Verification {
     if (started) this.add(scenario33Started(waitedId, started, since, VALUES_STACK, login));
   }
 
+  // 35: a deploy freeze that holds now and ends a few minutes from now. A
+  // tick inside it waits and its row names the freeze; "Run workflow" after
+  // its end starts the deploy. The freeze is on the wall of the dashboard
+  // zone, which on the test bed is UTC.
+  private async freeze(login: string): Promise<void> {
+    const config = "sluiceway.yaml";
+    const now = Date.now();
+    const from = new Date(Math.floor(now / 60_000) * 60_000 - 60_000);
+    const ends = new Date(Math.ceil((now + 8 * 60_000) / 60_000) * 60_000);
+    const at = (d: Date) => d.toISOString().slice(0, 16);
+    const frozen = await this.step([35], ["Pu"], () =>
+      this.bed.pushEdit(`a deploy freeze until ${at(ends)} UTC`, (files) => {
+        const text = files.get(config) ?? "";
+        if (!text.includes("\nstacks:\n")) throw new HarnessError(`${config} has no stacks list to put the freeze before.`);
+        const block = `# A deploy freeze (release verification, scenario 35).\nfreezes:\n  - from: "${at(from)}"\n    to: "${at(ends)}"\n    reason: ${FREEZE_REASON}\n\n`;
+        return files.set(config, text.replace("\nstacks:\n", `\n${block}stacks:\n`));
+      }),
+    );
+    if (!frozen) return;
+    this.add(scenario35Line(frozen, ends));
+    const since = new Date();
+    const waiting = await this.step([35], ["Pu"], () => this.bed.tick(`a tick on ${FREEZE_STACK} inside the freeze`, [FREEZE_STACK]));
+    if (!waiting) return;
+    if (Date.now() >= ends.getTime()) {
+      this.mark([35], ["Pu"], "error", `the tick's run ended after the freeze ended at ${at(ends)} UTC, so it proves nothing about a freeze that holds`);
+      return;
+    }
+    this.add(scenario35Waiting(waiting, since, FREEZE_STACK, login, ends));
+    const waitedId = madeIn(waiting, since).find((d) => d.task === `sluiceway:${FREEZE_STACK}`)?.id;
+    this.log(`waiting until the freeze ends at ${at(ends)} UTC`);
+    await sleep(ends.getTime() - Date.now() + 20_000);
+    const after = new Date();
+    const started = await this.step([35], ["Pu"], () => this.bed.dispatch("a run after the freeze ended"));
+    if (started) this.add(scenario35Started(waitedId, started, after, FREEZE_STACK, login));
+  }
+
+  // 36: compact rows and In sync off, which also takes out the freeze of 35,
+  // then the keys taken out.
+  private async layout(): Promise<void> {
+    const config = "sluiceway.yaml";
+    const before = this.observed.at(-1);
+    const compact = await this.step([36], ADAPTERS, () =>
+      this.bed.pushEdit("dashboard.pendingDetail: compact and inSyncSection: off", (files) => {
+        let text = files.get(config) ?? "";
+        text = text.replace(/# A deploy freeze \(release verification, scenario 35\)\.\nfreezes:\n(?: {2,}.*\n)*\n/, "");
+        if (!text.includes("dashboard:\n")) throw new HarnessError(`${config} has no dashboard settings to add the layout keys to.`);
+        return files.set(config, text.replace("dashboard:\n", "dashboard:\n  pendingDetail: compact\n  inSyncSection: off\n"));
+      }),
+    );
+    if (!compact || !before) return;
+    this.add(scenario36Compact(before, compact));
+    const back = await this.step([36], ADAPTERS, () =>
+      this.bed.pushEdit("the layout keys taken out", (files) =>
+        files.set(config, (files.get(config) ?? "").replace("  pendingDetail: compact\n  inSyncSection: off\n", "")),
+      ),
+    );
+    if (back) this.add(scenario36Back(before, back));
+  }
+
   async run(): Promise<void> {
     const base = all(BASE_STACKS);
     const login = (await this.github.get<{ login: string }>("/user")).login;
@@ -208,7 +271,7 @@ export class Verification {
 
     // 1 and 3: the first scan on a reset test bed.
     let since = new Date();
-    const first = await this.step([1, 2, 3, 4, 5, 6, 7, 17, 18, 19, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34], ADAPTERS, () => this.bed.push("the base fixtures", baseTree(this.values)));
+    const first = await this.step([1, 2, 3, 4, 5, 6, 7, 17, 18, 19, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37], ADAPTERS, () => this.bed.push("the base fixtures", baseTree(this.values)));
     if (!first) return;
     const pinned = await pinnedIssues(this.github);
     const issue = first.issues[0];
@@ -412,6 +475,8 @@ export class Verification {
     void merged;
 
     await this.onMerge(login);
+    await this.freeze(login);
+    await this.layout();
 
     // 21: two ticks within seconds, by two people.
     if (!this.second) {
@@ -466,6 +531,9 @@ export class Verification {
       this.add(scenario27(big, BIG_STACKS, BIG_CHANGES, runs));
     }
 
+    // 37: the counts on the marker of every pending row a scan wrote.
+    this.add(scenario37(this.observed));
+
     // 19: every result file of every step.
     try {
       this.add(scenario19(await fetchSchema(this.github, this.version), this.observed));
diff --git a/release-verify/versions.json b/release-verify/versions.json
index f5c2ab0..731b7f1 100644
--- a/release-verify/versions.json
+++ b/release-verify/versions.json
@@ -1,5 +1,5 @@
 {
-  "SLUICEWAY_VERSION": "v0.41.0",
+  "SLUICEWAY_VERSION": "v0.44.0",
   "PULUMI_VERSION": "3.263.0",
   "TOFU_VERSION": "1.12.6"
 }