diff --git a/README.md b/README.md
index 35c8533..c74b137 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,16 @@ Every module remains standalone: download only the check you need, verify its ch
 
 ## Master `onescript` CLI
 
-The master requires a complete verified checkout containing `onescript`, `catalog.tsv`, `SHA256SUMS`, and `scripts/`. The launcher and Linux server diagnostics wave are v2.1.0 release candidates and are not part of the existing `v2.0.0` release; version-pinned installation commands will be added only when that release is approved and published.
+The v2.1.0 release provides the complete verified catalog: `onescript`, `catalog.tsv`, `SHA256SUMS`, and all 14 standalone modules under `scripts/`. The four original v2.0.0 modules remain unchanged while the launcher and ten Linux server diagnostics are added in v2.1.0.
+
+Version-pinned verified checkout:
+
+```bash
+git clone --depth 1 --branch v2.1.0 https://github.com/RomeoRaven/ONEScripts.git &&
+cd ONEScripts &&
+sha256sum -c --strict SHA256SUMS &&
+./onescript doctor
+```
 
 Verify the installed catalog:
 
@@ -65,7 +74,7 @@ Collects a privacy-reduced profile covering OS, resources, filesystems, cPanel,
 One-line invocation:
 
 ```bash
-(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/vps-profile.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/vps-profile.sh' && printf '%s  %s\n' 'd260a50a2fb3fa0af09edf310da8006246924cf4319a05ad2935c19fd91911ed' "$tmp_dir/vps-profile.sh" | sha256sum -c - && chmod 700 "$tmp_dir/vps-profile.sh" && "$tmp_dir/vps-profile.sh" ./vps-profile.txt)
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/vps-profile.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/vps-profile.sh' && printf '%s  %s\n' 'd260a50a2fb3fa0af09edf310da8006246924cf4319a05ad2935c19fd91911ed' "$tmp_dir/vps-profile.sh" | sha256sum -c - && chmod 700 "$tmp_dir/vps-profile.sh" && "$tmp_dir/vps-profile.sh" ./vps-profile.txt)
 ```
 
 ### `cpanel-followup-triage.sh`
@@ -75,7 +84,7 @@ Reports failed systemd units, privacy-safe Exim queue counts, and bind scope for
 One-line invocation:
 
 ```bash
-(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/cpanel-followup-triage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/cpanel-followup-triage.sh' && printf '%s  %s\n' '5bb1e14491437c42cf6d5169186a2545176dcbbf5ba4367d84aabf0e851f0a23' "$tmp_dir/cpanel-followup-triage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/cpanel-followup-triage.sh" && "$tmp_dir/cpanel-followup-triage.sh")
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/cpanel-followup-triage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/cpanel-followup-triage.sh' && printf '%s  %s\n' '5bb1e14491437c42cf6d5169186a2545176dcbbf5ba4367d84aabf0e851f0a23' "$tmp_dir/cpanel-followup-triage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/cpanel-followup-triage.sh" && "$tmp_dir/cpanel-followup-triage.sh")
 ```
 
 ### `directory-sizes.sh`
@@ -85,7 +94,7 @@ Lists immediate subdirectories by allocated disk usage, largest first. Hidden di
 One-line invocation for the current directory:
 
 ```bash
-(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/directory-sizes.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/directory-sizes.sh' && printf '%s  %s\n' '156ea405829ec5c27ed7a462a23e2fe9752704467c93fbc652aef205d24ca65d' "$tmp_dir/directory-sizes.sh" | sha256sum -c - && chmod 700 "$tmp_dir/directory-sizes.sh" && "$tmp_dir/directory-sizes.sh" .)
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/directory-sizes.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/directory-sizes.sh' && printf '%s  %s\n' '156ea405829ec5c27ed7a462a23e2fe9752704467c93fbc652aef205d24ca65d' "$tmp_dir/directory-sizes.sh" | sha256sum -c - && chmod 700 "$tmp_dir/directory-sizes.sh" && "$tmp_dir/directory-sizes.sh" .)
 ```
 
 ### `exim-queue-health.sh`
@@ -95,12 +104,12 @@ Prints only total, frozen, older-than-one-hour, and older-than-one-day Exim queu
 One-line invocation:
 
 ```bash
-(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/exim-queue-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/exim-queue-health.sh' && printf '%s  %s\n' 'cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22' "$tmp_dir/exim-queue-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/exim-queue-health.sh" && "$tmp_dir/exim-queue-health.sh")
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/exim-queue-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/exim-queue-health.sh' && printf '%s  %s\n' 'cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22' "$tmp_dir/exim-queue-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/exim-queue-health.sh" && "$tmp_dir/exim-queue-health.sh")
 ```
 
-## Linux server diagnostics wave (v2.1.0 candidate)
+## Linux server diagnostics wave (v2.1.0)
 
-These modules are available from the current checkout. Findings use concise `key=value` output. A successful collection returns `0` even when `status=warning|critical|stale`; usage errors return `2`, and collection failures return `1`.
+These modules are published in v2.1.0. Findings use concise `key=value` output. A successful collection returns `0` even when `status=warning|critical|stale`; usage errors return `2`, and collection failures return `1`.
 
 ### `filesystem-health.sh`
 
@@ -110,6 +119,12 @@ Reports mounted-filesystem capacity and inode pressure by index, without device
 ./scripts/filesystem-health.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/filesystem-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/filesystem-health.sh' && printf '%s  %s\n' '0b4608698315cf1ed19b532e453ff08fe9aeab93a0a8492793217c9002c5a12f' "$tmp_dir/filesystem-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/filesystem-health.sh" && "$tmp_dir/filesystem-health.sh")
+```
+
 ### `memory-pressure.sh`
 
 Reports memory and swap use, one-minute load normalized by online CPU count, and Linux PSI values when available. It does not list processes or command lines.
@@ -118,6 +133,12 @@ Reports memory and swap use, one-minute load normalized by online CPU count, and
 ./scripts/memory-pressure.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/memory-pressure.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/memory-pressure.sh' && printf '%s  %s\n' '859fcefc6b631f9b63e28db8c2f58372e55adfe567e70c3d2317e609b5543d59' "$tmp_dir/memory-pressure.sh" | sha256sum -c - && chmod 700 "$tmp_dir/memory-pressure.sh" && "$tmp_dir/memory-pressure.sh")
+```
+
 ### `service-health.sh`
 
 Reports aggregate systemd state and failed-unit count. Unit names remain omitted unless `--show-units` is explicitly supplied.
@@ -126,6 +147,12 @@ Reports aggregate systemd state and failed-unit count. Unit names remain omitted
 ./scripts/service-health.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/service-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/service-health.sh' && printf '%s  %s\n' 'c35c04f1f5f54eb945b46cbd6ebecb05146f02baf8f7de5bbe967c494ec5bb56' "$tmp_dir/service-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/service-health.sh" && "$tmp_dir/service-health.sh")
+```
+
 ### `listener-exposure.sh`
 
 Lists listener protocol, port, and bind scope (`loopback`, `specific-address`, or `all-interfaces`) without displaying literal addresses or process details.
@@ -134,6 +161,12 @@ Lists listener protocol, port, and bind scope (`loopback`, `specific-address`, o
 ./scripts/listener-exposure.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/listener-exposure.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/listener-exposure.sh' && printf '%s  %s\n' 'a12029e59604066a57edf0bd12668a34031779d59838957d7991973580ea8c2f' "$tmp_dir/listener-exposure.sh" | sha256sum -c - && chmod 700 "$tmp_dir/listener-exposure.sh" && "$tmp_dir/listener-exposure.sh")
+```
+
 ### `update-posture.sh`
 
 Counts updates visible in existing APT or DNF metadata, reports deferred/kept-back APT candidates as a privacy-safe aggregate, and checks the reboot-required marker. It never refreshes metadata, lists package names, installs updates, or reboots.
@@ -142,6 +175,12 @@ Counts updates visible in existing APT or DNF metadata, reports deferred/kept-ba
 ./scripts/update-posture.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/update-posture.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/update-posture.sh' && printf '%s  %s\n' '2bcf1ab868d6055c61b507407b424cd753894bc8d0b190e06c9a156281dbeb59' "$tmp_dir/update-posture.sh" | sha256sum -c - && chmod 700 "$tmp_dir/update-posture.sh" && "$tmp_dir/update-posture.sh")
+```
+
 ### `backup-freshness.sh`
 
 Finds the newest regular file among explicit files and immediate directory entries. It does not recurse and reports age/count only; use `--show-names` or `--show-paths` explicitly for local diagnosis.
@@ -150,6 +189,12 @@ Finds the newest regular file among explicit files and immediate directory entri
 ./scripts/backup-freshness.sh --max-hours 24 /srv/backups
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/backup-freshness.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/backup-freshness.sh' && printf '%s  %s\n' 'fe3e47781e5694ebcc2c260df97bb3421fa5e13fa353c0e25e00c9ecffaf2a8b' "$tmp_dir/backup-freshness.sh" | sha256sum -c - && chmod 700 "$tmp_dir/backup-freshness.sh" && "$tmp_dir/backup-freshness.sh" /srv/backups)
+```
+
 ### `endpoint-health.sh`
 
 Probes explicit HTTP(S) endpoints and reports status and latency by input index. URLs, query strings, headers, and response bodies are omitted.
@@ -158,6 +203,12 @@ Probes explicit HTTP(S) endpoints and reports status and latency by input index.
 ./scripts/endpoint-health.sh https://example.com/health
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/endpoint-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/endpoint-health.sh' && printf '%s  %s\n' '46d3961f9364b9ccf7cda154dcef52810855aaf6040ac08a416d641b014e84fb' "$tmp_dir/endpoint-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/endpoint-health.sh" && "$tmp_dir/endpoint-health.sh" https://example.com/health)
+```
+
 ### `tls-expiry.sh`
 
 Verifies explicit TLS targets and reports certificate lifetime by input index. Hostnames, addresses, subjects, and issuers are omitted.
@@ -166,6 +217,12 @@ Verifies explicit TLS targets and reports certificate lifetime by input index. H
 ./scripts/tls-expiry.sh example.com:443
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/tls-expiry.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/tls-expiry.sh' && printf '%s  %s\n' 'ea624496235f3d78cd38be3173f6bb18d898d7cc25b71fe36d678459691b61f0' "$tmp_dir/tls-expiry.sh" | sha256sum -c - && chmod 700 "$tmp_dir/tls-expiry.sh" && "$tmp_dir/tls-expiry.sh" example.com:443)
+```
+
 ### `container-health.sh`
 
 Reports aggregate Docker or Podman running, stopped, and unhealthy counts. Names, images, IDs, ports, labels, and commands are omitted. If Docker is installed but unavailable, a usable Podman runtime is tried.
@@ -174,6 +231,12 @@ Reports aggregate Docker or Podman running, stopped, and unhealthy counts. Names
 ./scripts/container-health.sh
 ```
 
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/container-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/container-health.sh' && printf '%s  %s\n' '6166f768a4f242db8e077438ebdc2736ffbafd5306dd0d1adbb1da7b0b75b26b' "$tmp_dir/container-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/container-health.sh" && "$tmp_dir/container-health.sh")
+```
+
 ### `log-storage.sh`
 
 Measures allocated size for explicit log directories, defaulting to `/var/log`, without reading log contents. Paths are omitted unless `--show-paths` is supplied. If permissions hide a child directory but `du` still returns a numeric total, the result is retained and marked `collection_complete=no`.
@@ -182,14 +245,20 @@ Measures allocated size for explicit log directories, defaulting to `/var/log`,
 ./scripts/log-storage.sh
 ```
 
-These modules intentionally have no remote one-line invocation until the v2.1.0 tag and release checksums are approved and published.
+Version-pinned one-line invocation:
+
+```bash
+(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/log-storage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/log-storage.sh' && printf '%s  %s\n' '3eb2acfbbaf9643ebf50b7822fa6e6d7908f421abb7edfc2521ac5ebafa0422a' "$tmp_dir/log-storage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/log-storage.sh" && "$tmp_dir/log-storage.sh" /var/log)
+```
+
+Each version-pinned command downloads into a private temporary directory, verifies the exact v2.1.0 checksum, and executes only after verification succeeds.
 
 ## Direct module use
 
-Clone the repository and run a script directly:
+After completing the version-pinned verified checkout above, run a script directly:
 
 ```bash
-git clone https://github.com/RomeoRaven/ONEScripts.git && cd ONEScripts && ./scripts/vps-profile.sh ./vps-profile.txt
+./scripts/vps-profile.sh ./vps-profile.txt
 ```
 
 Every module supports `--help` and `--version` and remains directly executable without the master.
diff --git a/tests/test-scripts.sh b/tests/test-scripts.sh
index 9abbe88..c27865b 100755
--- a/tests/test-scripts.sh
+++ b/tests/test-scripts.sh
@@ -2,7 +2,7 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="2.0.0"
+VERSION="2.1.0"
 SCRIPTS=(
   "scripts/vps-profile.sh"
   "scripts/cpanel-followup-triage.sh"
@@ -19,12 +19,7 @@ SCRIPTS=(
   "scripts/container-health.sh"
   "scripts/log-storage.sh"
 )
-RELEASED_SCRIPTS=(
-  "scripts/vps-profile.sh"
-  "scripts/cpanel-followup-triage.sh"
-  "scripts/directory-sizes.sh"
-  "scripts/exim-queue-health.sh"
-)
+RELEASED_SCRIPTS=("${SCRIPTS[@]}")
 
 expected_version() {
   case "$1" in
@@ -451,6 +446,7 @@ for checksummed in onescript catalog.tsv "${SCRIPTS[@]}"; do
 done
 
 if [[ -f "$ROOT/README.md" ]]; then
+  mapfile -t readme_lines <"$ROOT/README.md"
   for relative in "${SCRIPTS[@]}"; do
     name="${relative##*/}"
     if grep -Fq "$name" "$ROOT/README.md"; then
@@ -463,18 +459,104 @@ if [[ -f "$ROOT/README.md" ]]; then
     name="${relative##*/}"
     expected_url="https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v${VERSION}/${relative}"
     checksum="$(sha256sum "$ROOT/$relative" 2>/dev/null | awk '{print $1}')"
-    invocation_line="$(grep -F "$expected_url" "$ROOT/README.md" 2>/dev/null || true)"
-    if [[ -n "$invocation_line" && "$invocation_line" == *"$checksum"* ]]; then
-      pass "README pins and checksum-binds $name"
+    case "$relative" in
+      scripts/vps-profile.sh) invocation_args=' ./vps-profile.txt' ;;
+      scripts/directory-sizes.sh) invocation_args=' .' ;;
+      scripts/backup-freshness.sh) invocation_args=' /srv/backups' ;;
+      scripts/endpoint-health.sh) invocation_args=' https://example.com/health' ;;
+      scripts/tls-expiry.sh) invocation_args=' example.com:443' ;;
+      scripts/log-storage.sh) invocation_args=' /var/log' ;;
+      *) invocation_args='' ;;
+    esac
+    expected_invocation="(tmp_dir=\"\$(mktemp -d)\" && chmod 700 \"\$tmp_dir\" && trap 'rm -rf \"\$tmp_dir\"' EXIT && curl -fsSLo \"\$tmp_dir/$name\" '$expected_url' && printf '%s  %s\\n' '$checksum' \"\$tmp_dir/$name\" | sha256sum -c - && chmod 700 \"\$tmp_dir/$name\" && \"\$tmp_dir/$name\"$invocation_args)"
+    invocation_indexes=()
+    for readme_index in "${!readme_lines[@]}"; do
+      if [[ "${readme_lines[$readme_index]}" == *"$expected_url"* ]]; then
+        invocation_indexes+=("$readme_index")
+      fi
+    done
+    if ((${#invocation_indexes[@]} == 1)); then
+      invocation_index="${invocation_indexes[0]}"
     else
-      fail "README pins and checksum-binds $name"
+      invocation_index=-1
     fi
-    if [[ "$invocation_line" == \(* && "$invocation_line" == *'mktemp -d'* && "$invocation_line" == *"trap 'rm -rf"* && "$invocation_line" != *"/tmp/$name"* ]]; then
-      pass "README uses a race-safe temporary download for $name"
+    if ((invocation_index > 0 && invocation_index + 1 < ${#readme_lines[@]})) \
+      && [[ "${readme_lines[$invocation_index]}" == "$expected_invocation" ]] \
+      && [[ "${readme_lines[$((invocation_index - 1))]}" == '```bash' ]] \
+      && [[ "${readme_lines[$((invocation_index + 1))]}" == '```' ]]; then
+      pass "README has exactly one single-line canonical fence for $name"
     else
-      fail "README uses a race-safe temporary download for $name"
+      fail "README has exactly one single-line canonical fence for $name"
+    fi
+    if bash -n -c "$expected_invocation" 2>/dev/null; then
+      pass "README canonical invocation parses for $name"
+    else
+      fail "README canonical invocation parses for $name"
     fi
   done
+  mapfile -t readme_download_lines < <(grep -F -- 'curl -fsSLo ' "$ROOT/README.md" 2>/dev/null || true)
+  assert_eq "README has exactly 14 standalone download invocations" "14" "${#readme_download_lines[@]}"
+  checkout_heading='Version-pinned verified checkout:'
+  checkout_clone='git clone --depth 1 --branch v2.1.0 https://github.com/RomeoRaven/ONEScripts.git &&'
+  expected_checkout_block=$'git clone --depth 1 --branch v2.1.0 https://github.com/RomeoRaven/ONEScripts.git &&\ncd ONEScripts &&\nsha256sum -c --strict SHA256SUMS &&\n./onescript doctor'
+  checkout_heading_count="$(grep -Fxc -- "$checkout_heading" "$ROOT/README.md" 2>/dev/null || true)"
+  mapfile -t checkout_clone_lines < <(grep -F -- 'git clone' "$ROOT/README.md" 2>/dev/null || true)
+  actual_checkout_block="$(
+    awk -v heading="$checkout_heading" '
+      $0 == heading { state = 1; next }
+      state == 1 && $0 == "" { state = 2; next }
+      state == 2 && $0 == "```bash" { state = 3; next }
+      state == 3 && $0 == "```" { exit }
+      state == 3 { print; next }
+      state > 0 { exit }
+    ' "$ROOT/README.md"
+  )"
+  assert_eq "README has exactly one verified-checkout heading" "1" "$checkout_heading_count"
+  assert_eq "README has exactly one clone command" "1" "${#checkout_clone_lines[@]}"
+  assert_eq "README clone command is the fail-closed pinned v2.1.0 form" "$checkout_clone" "${checkout_clone_lines[0]:-missing}"
+  assert_eq "README verified-checkout fence is the exact canonical block" "$expected_checkout_block" "$actual_checkout_block"
+
+  checkout_probe="$TMP/checkout-probe"
+  checkout_marker="$checkout_probe/doctor-ran"
+  checkout_doctor_template="$checkout_probe/onescript"
+  mkdir -p "$checkout_probe/bin" "$checkout_probe/ONEScripts"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    "[[ \"\${CHECKOUT_GIT_FAIL:-0}\" == 1 ]] && exit 31" \
+    'mkdir -p ONEScripts' \
+    "cp \"\$CHECKOUT_DOCTOR_TEMPLATE\" ONEScripts/onescript" \
+    'chmod 700 ONEScripts/onescript' >"$checkout_probe/bin/git"
+  printf '%s\n' \
+    '#!/usr/bin/env bash' \
+    "[[ \"\${CHECKOUT_SHA_FAIL:-0}\" == 1 ]] && exit 32" \
+    'exit 0' >"$checkout_probe/bin/sha256sum"
+  printf '%s\n' '#!/usr/bin/env bash' "printf 'doctor-ran\\n' >\"\$CHECKOUT_MARKER\"" >"$checkout_doctor_template"
+  cp "$checkout_doctor_template" "$checkout_probe/ONEScripts/onescript"
+  chmod 700 "$checkout_probe/bin/git" "$checkout_probe/bin/sha256sum" "$checkout_doctor_template" "$checkout_probe/ONEScripts/onescript"
+  if (cd "$checkout_probe" && CHECKOUT_GIT_FAIL=1 CHECKOUT_MARKER="$checkout_marker" CHECKOUT_DOCTOR_TEMPLATE="$checkout_doctor_template" PATH="$checkout_probe/bin:$PATH" bash -c "$actual_checkout_block") >/dev/null 2>&1; then
+    fail "README verified checkout stops after clone failure"
+  elif [[ ! -e "$checkout_marker" ]]; then
+    pass "README verified checkout stops after clone failure"
+  else
+    fail "README verified checkout stops after clone failure"
+  fi
+  rm -rf "$checkout_probe/ONEScripts" "$checkout_marker"
+  if (cd "$checkout_probe" && CHECKOUT_SHA_FAIL=1 CHECKOUT_MARKER="$checkout_marker" CHECKOUT_DOCTOR_TEMPLATE="$checkout_doctor_template" PATH="$checkout_probe/bin:$PATH" bash -c "$actual_checkout_block") >/dev/null 2>&1; then
+    fail "README verified checkout stops after checksum failure"
+  elif [[ ! -e "$checkout_marker" ]]; then
+    pass "README verified checkout stops after checksum failure"
+  else
+    fail "README verified checkout stops after checksum failure"
+  fi
+  rm -rf "$checkout_probe/ONEScripts" "$checkout_marker"
+  if (cd "$checkout_probe" && CHECKOUT_MARKER="$checkout_marker" CHECKOUT_DOCTOR_TEMPLATE="$checkout_doctor_template" PATH="$checkout_probe/bin:$PATH" bash -c "$actual_checkout_block") >/dev/null 2>&1 \
+    && [[ -f "$checkout_marker" ]]; then
+    pass "README verified checkout reaches doctor after successful verification"
+  else
+    fail "README verified checkout reaches doctor after successful verification"
+  fi
+  release_hold_hits="$(grep -nE 'release candidate|not part of the existing|only when that release is approved|until the v2[.]1[.]0 tag' "$ROOT/README.md" 2>/dev/null || true)"
+  assert_eq "README removes v2.1.0 candidate and release-hold language" "" "$release_hold_hits"
 else
   fail "README exists"
 fi