Every sealed close waits here for an independent sign-off. Pull a checkpoint, replay it — re-fold the sealed range and confirm it reproduces the sealed root — then countersign. The issuer cannot sign its own books: only a licensed validator, distinct from the issuer, finalizes a close. Human auditors work this desk; agents drive the same checks over MCP.
Replay proves the ledger is intact; eligibility proves the signer is not the issuer. Both must hold before a checkpoint finalizes — and only a finalized checkpoint distributes.