@@ -2750,6 +2750,11 @@ def _prepare_resume_locked(project: Path, run_dir: Path):
             sweep_options = runsetup.load_sweep_resume_options(
                 run_dir,
                 required=state.sweep_options_version >= runsetup.SWEEP_OPTIONS_VERSION,
+                expected_digest=(
+                    state.sweep_options_digest
+                    if state.sweep_options_version == runsetup.SWEEP_OPTIONS_VERSION
+                    else None
+                ),
             )
         except runsetup.SweepOptionsError as exc:
             print(f"cannot resume {run_dir.name}: {exc}", file=sys.stderr)
 
@@ -764,6 +764,10 @@ class RunState:
     # shape. Selector-capable sweeps stamp the current nonzero version at launch,
     # so losing sweep.json cannot silently widen them on resume.
     sweep_options_version: int = 0
+    # SHA-256 of the exact sweep.json bytes published for the current format.
+    # State and options are separate atomic files; this binding makes replacing
+    # a targeted run's valid options with an unrestricted document fail closed.
+    sweep_options_digest: str = ""
     # story-queue source (policy.StoriesPolicy.source), pinned at run start so
     # resume/resolve rebuild the right engine (StoriesEngine vs the sprint Engine)
     # without re-reading policy — a policy edit mid-run must not switch a live run's
@@ -862,6 +866,7 @@ def to_dict(self) -> dict[str, Any]:
             "crash_error": self.crash_error,
             "run_type": self.run_type,
             "sweep_options_version": self.sweep_options_version,
+            "sweep_options_digest": self.sweep_options_digest,
             "source": self.source,
             "spec_folder": self.spec_folder,
             "sweep_cycle": self.sweep_cycle,
@@ -895,6 +900,7 @@ def from_dict(cls, d: dict[str, Any]) -> "RunState":
             crash_error=d.get("crash_error"),
             run_type=str(d.get("run_type", "story")),
             sweep_options_version=int(d.get("sweep_options_version", 0)),
+            sweep_options_digest=str(d.get("sweep_options_digest", "")),
             source=str(d.get("source", "sprint-status")),
             spec_folder=str(d.get("spec_folder", "")),
             sweep_cycle=int(d.get("sweep_cycle", 1)),
 
@@ -82,7 +82,7 @@ def __call__(
 # actually builds them) and re-exported as ``cli.ROLES``, which `cmd_validate`
 # and the test suite resolve.
 ROLES = ("dev", "review", "triage")
-SWEEP_OPTIONS_VERSION = 1
+SWEEP_OPTIONS_VERSION = 2
 _MAX_SWEEP_OPTIONS_BYTES = 64 * 1024
 
 
@@ -843,9 +843,15 @@ class SweepResumeOptions:
     values: dict[str, Any]
     only_ids: tuple[str, ...] | None
     min_severity: str | None
+    digest: str | None = None
 
 
-def load_sweep_resume_options(run_dir: Path, *, required: bool = False) -> SweepResumeOptions:
+def load_sweep_resume_options(
+    run_dir: Path,
+    *,
+    required: bool = False,
+    expected_digest: str | None = None,
+) -> SweepResumeOptions:
     """Load bounded, non-redirected sweep.json bytes and validate selectors."""
 
     def corrupt(message: str, *, cause: BaseException | None = None) -> SweepResumeOptions:
@@ -893,6 +899,9 @@ def corrupt(message: str, *, cause: BaseException | None = None) -> SweepResumeO
     data = b"".join(chunks)
     if len(data) > _MAX_SWEEP_OPTIONS_BYTES:
         raise SweepOptionsError(f"sweep.json exceeds {_MAX_SWEEP_OPTIONS_BYTES} bytes")
+    digest = hashlib.sha256(data).hexdigest()
+    if expected_digest is not None and digest != expected_digest:
+        raise SweepOptionsError("sweep.json no longer matches the options bound at launch")
     try:
         text = data.decode("utf-8")
     except UnicodeDecodeError as exc:
@@ -943,24 +952,33 @@ def corrupt(message: str, *, cause: BaseException | None = None) -> SweepResumeO
 
     if only_ids is not None and min_severity is not None:
         return corrupt("sweep.json cannot contain both 'only' and 'min_severity'")
-    # Missing keys are the pre-selector format and remain unrestricted. Explicit
-    # nulls are the current unrestricted format; both intentionally converge.
-    if not only_present:
+    # Version-zero callers predate selectors and must never inherit selector-
+    # shaped keys from a stray or replaced options file.  Current callers pass
+    # ``required=True`` and bind these exact bytes through RunState.
+    if not required or not only_present:
         only_ids = None
-    if not min_present:
+    if not required or not min_present:
         min_severity = None
-    return SweepResumeOptions(opts, only_ids, min_severity)
+    return SweepResumeOptions(opts, only_ids, min_severity, digest)
 
 
 def validate_sweep_options_version(version: int) -> None:
     """Refuse state whose sweep options semantics this binary cannot interpret."""
-    if version < 0 or version > SWEEP_OPTIONS_VERSION:
+    if version not in (0, SWEEP_OPTIONS_VERSION):
         raise SweepOptionsError(
-            f"unsupported sweep options version {version}; this binary supports "
-            f"0 through {SWEEP_OPTIONS_VERSION}"
+            f"unsupported sweep options version {version}; this binary supports legacy 0 "
+            f"or current {SWEEP_OPTIONS_VERSION}"
         )
 
 
+def validate_sweep_options_binding(
+    version: int, expected_digest: str, options: SweepResumeOptions
+) -> None:
+    """Bind current sweep options to the exact bytes published at launch."""
+    if version == SWEEP_OPTIONS_VERSION and options.digest != expected_digest:
+        raise SweepOptionsError("sweep.json no longer matches the options bound at launch")
+
+
 def _claim_run_dir(run_dir: Path) -> os.stat_result:
     """Take exclusive ownership of a fresh run directory, refusing an id that
     already names a run.
@@ -1313,6 +1331,7 @@ def compose_sweep(
         "trigger": trigger,
     }
     options_text = json.dumps(options, indent=2)
+    options_digest = hashlib.sha256(options_text.encode("utf-8")).hexdigest()
     if len(options_text.encode("utf-8")) > _MAX_SWEEP_OPTIONS_BYTES:
         raise SweepOptionsError(f"sweep options exceed {_MAX_SWEEP_OPTIONS_BYTES} bytes")
 
@@ -1334,6 +1353,7 @@ def compose_sweep(
             policy_snapshot=policy.to_dict(),
             run_type="sweep",
             sweep_options_version=SWEEP_OPTIONS_VERSION,
+            sweep_options_digest=options_digest,
             trusted_config_digest=trusted_config_digest,
         )
         # Persist the sweep options atomically (tmp + os.replace), the way save_state
@@ -1421,12 +1441,25 @@ def compose_resume(
         if sweep_options is not None
         else (
             load_sweep_resume_options(
-                run_dir, required=state.sweep_options_version >= SWEEP_OPTIONS_VERSION
+                run_dir,
+                required=state.sweep_options_version >= SWEEP_OPTIONS_VERSION,
+                expected_digest=(
+                    state.sweep_options_digest
+                    if state.sweep_options_version == SWEEP_OPTIONS_VERSION
+                    else None
+                ),
             )
             if state.run_type == "sweep"
             else None
         )
     )
+    if state.run_type == "sweep":
+        assert resolved_sweep_options is not None
+        validate_sweep_options_binding(
+            state.sweep_options_version,
+            state.sweep_options_digest,
+            resolved_sweep_options,
+        )
     # drop any stale agent session so the run spins up a fresh one (a stopped or
     # interrupted run can leave a lingering bmad-loop-<id> session behind).
     runs.kill_session(run_dir.name)
 
@@ -1,6 +1,7 @@
 """CLI command tests — init policy-derived profiles and per-stage dry-run."""
 
 import argparse
+import hashlib
 import io
 import json
 import ntpath
@@ -1833,6 +1834,7 @@ def test_public_resume_refuses_malformed_selectors_before_mutation(
         monkeypatch,
         run_type="sweep",
         sweep_options_version=runsetup.SWEEP_OPTIONS_VERSION,
+        sweep_options_digest=hashlib.sha256(contents.encode("utf-8")).hexdigest(),
     )
     (run_dir / "sweep.json").write_text(contents, encoding="utf-8")
     state_before = (run_dir / "state.json").read_bytes()
@@ -6161,6 +6163,7 @@ def test_public_resume_refuses_missing_current_sweep_options_before_mutation(
         monkeypatch,
         run_type="sweep",
         sweep_options_version=runsetup.SWEEP_OPTIONS_VERSION,
+        sweep_options_digest=hashlib.sha256(b"{}").hexdigest(),
     )
     (run_dir / "sweep.json").unlink(missing_ok=True)
     state_before = (run_dir / "state.json").read_bytes()
@@ -6207,6 +6210,7 @@ def test_public_resume_refuses_incomplete_current_sweep_options_before_mutation(
         monkeypatch,
         run_type="sweep",
         sweep_options_version=runsetup.SWEEP_OPTIONS_VERSION,
+        sweep_options_digest=hashlib.sha256(b"{}").hexdigest(),
     )
     (run_dir / "sweep.json").write_text("{}", encoding="utf-8")
     state_before = (run_dir / "state.json").read_bytes()
@@ -6218,6 +6222,29 @@ def test_public_resume_refuses_incomplete_current_sweep_options_before_mutation(
     assert (run_dir / "state.json").read_bytes() == state_before
 
 
+def test_public_resume_refuses_replacing_targeted_options_with_unrestricted_json(
+    project, monkeypatch, capsys
+):
+    targeted = json.dumps({"only": ["DW-1"], "min_severity": None})
+    run_dir = _paused_run_for_resume(
+        project,
+        monkeypatch,
+        run_type="sweep",
+        sweep_options_version=runsetup.SWEEP_OPTIONS_VERSION,
+        sweep_options_digest=hashlib.sha256(targeted.encode("utf-8")).hexdigest(),
+    )
+    (run_dir / "sweep.json").write_text(
+        json.dumps({"only": None, "min_severity": None}), encoding="utf-8"
+    )
+    state_before = (run_dir / "state.json").read_bytes()
+    monkeypatch.setattr(cli, "SweepEngine", lambda **_kwargs: pytest.fail("engine constructed"))
+
+    assert cli._resume_paused_run(project.project, run_dir) == 1
+
+    assert "bound at launch" in capsys.readouterr().err
+    assert (run_dir / "state.json").read_bytes() == state_before
+
+
 @pytest.mark.parametrize(
     ("only", "expected"),
     [(["DW-9"], 1), (None, 0)],
@@ -6226,16 +6253,15 @@ def test_public_resume_refuses_incomplete_current_sweep_options_before_mutation(
 def test_resume_crash_exit_is_failure_only_for_persisted_named_scope(
     project, monkeypatch, only, expected
 ):
+    options_text = json.dumps({"only": only, "min_severity": None})
     run_dir = _paused_run_for_resume(
         project,
         monkeypatch,
         run_type="sweep",
         sweep_options_version=runsetup.SWEEP_OPTIONS_VERSION,
+        sweep_options_digest=hashlib.sha256(options_text.encode("utf-8")).hexdigest(),
     )
-    (run_dir / "sweep.json").write_text(
-        json.dumps({"only": only, "min_severity": None}),
-        encoding="utf-8",
-    )
+    (run_dir / "sweep.json").write_text(options_text, encoding="utf-8")
     summary = types.SimpleNamespace(crashed=True, render=lambda: "CRASHED")
     engine = types.SimpleNamespace(run=lambda: summary)
     monkeypatch.setattr(
 
@@ -42,11 +42,15 @@ def test_run_state_stories_fields_default_and_round_trip():
 
 
 def test_run_state_sweep_options_version_round_trips_and_defaults_legacy():
-    state = _state(run_type="sweep", sweep_options_version=1)
-    assert RunState.from_dict(state.to_dict()).sweep_options_version == 1
+    state = _state(run_type="sweep", sweep_options_version=2, sweep_options_digest="a" * 64)
+    round_tripped = RunState.from_dict(state.to_dict())
+    assert round_tripped.sweep_options_version == 2
+    assert round_tripped.sweep_options_digest == "a" * 64
     legacy = state.to_dict()
     del legacy["sweep_options_version"]
+    del legacy["sweep_options_digest"]
     assert RunState.from_dict(legacy).sweep_options_version == 0
+    assert RunState.from_dict(legacy).sweep_options_digest == ""
 
 
 def test_run_state_code_root_restamp_pending_round_trips_and_defaults_false():