diff --git a/Dockerfile b/Dockerfile
index 32c7210..db4ae2e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -70,7 +70,9 @@ RUN set -eux; \
       /var/lib/gulogulo/runtime \
       /var/lib/gulogulo/dav \
       /var/lib/gulogulo/mail \
-      /var/lib/gulogulo/backups
+      /var/lib/gulogulo/backups \
+      /var/lib/gulogulo/queue \
+      /var/lib/gulogulo/lp7
 
 WORKDIR /app
 
diff --git a/compose.yaml b/compose.yaml
index 722da62..9f4e0be 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -1241,7 +1241,7 @@ services:
     platform: ${GULOGULO_LP7_COMPOSE_PLATFORM:-linux/amd64}
     profiles: ["lp7-check"]
     command: ["node", "--experimental-strip-types", "scripts/lp7-proof-check.ts"]
-    user: "0:0"
+    user: "10001:10001"
     environment:
       LP7_BLUE_BASE_URL: http://gulogulo-lp7-blue:8080
       LP7_GREEN_BASE_URL: http://gulogulo-lp7-green:8080
diff --git a/scripts/lp7-compose-audit.ts b/scripts/lp7-compose-audit.ts
index ac806df..3e509b6 100644
--- a/scripts/lp7-compose-audit.ts
+++ b/scripts/lp7-compose-audit.ts
@@ -150,6 +150,10 @@ for (const [name, section] of [['blue', blue], ['green', green]] as const) {
 for (const marker of ['gulogulo-lp7-blue:', 'gulogulo-lp7-green:', 'LP7_BLUE_BASE_URL:', 'LP7_GREEN_BASE_URL:', 'LP7_BLUE_DIGEST:', 'LP7_GREEN_DIGEST:']) {
   requireText(checker, marker, `LP7 checker marker ${marker}`);
 }
+requireText(checker, 'user: "10001:10001"', 'LP7 checker unprivileged UID');
+const checkerSource = await readFile(resolve(root, 'scripts/lp7-proof-check.ts'), 'utf8');
+requireText(checkerSource, 'saved.signature === continuitySignature', 'LP7 continuity signature comparison');
+if (checkerSource.includes('JSON.stringify(saved.signature)')) fail('LP7 checker double-serializes the saved continuity signature');
 for (const marker of ['gulogulo-lp7-blue:', 'gulogulo-lp7-green:']) {
   requireText(checker, marker, `LP7 checker dependency ${marker}`);
 }
diff --git a/scripts/lp7-proof-check.ts b/scripts/lp7-proof-check.ts
index 21a2700..d537b2a 100644
--- a/scripts/lp7-proof-check.ts
+++ b/scripts/lp7-proof-check.ts
@@ -207,7 +207,7 @@ await ensureSentinel('proof', join(stateDirectories.proof, 'lp7-proof-sentinel.j
 const savedContinuityPath = join(proofStateDirectory, 'lp7-dav-continuity.json');
 try {
   const saved = await readJson(savedContinuityPath, 'saved DAV continuity state');
-  assert(JSON.stringify(saved.signature) === continuitySignature, 'DAV continuity changed across the replacement rehearsal');
+  assert(saved.signature === continuitySignature, 'DAV continuity changed across the replacement rehearsal');
 } catch (error) {
   if (!isMissingFile(error)) throw error;
   await writeJson(savedContinuityPath, { schemaVersion: 1, milestone: 'LP7', signature: continuitySignature });