diff --git a/SESSION-M-TRANSCRIPT-2026-05-28T05-26--2026-05-28T06-50.md b/SESSION-M-TRANSCRIPT-2026-05-28T05-26--2026-05-28T06-50.md
index e4311e1..1b4b65b 100644
--- a/SESSION-M-TRANSCRIPT-2026-05-28T05-26--2026-05-28T06-50.md
+++ b/SESSION-M-TRANSCRIPT-2026-05-28T05-26--2026-05-28T06-50.md
@@ -24,8 +24,10 @@
 > (Session-L addition to SESSION-PROTOCOL.md). Three forked
 > subagents pre-assigned M.1 / M.2 / M.3; each writes its own
 > `SESSION-M.<n>-TRANSCRIPT-…md` before returning a tight report to
-> the driver. 13 §19.2 candidates surfaced across the three subs +
-> driver.
+> the driver. Driver had to extend the publish script's filename +
+> header validators mid-session — Session L documented the §5
+> validator extension but never landed it in the script (Arc 7).
+> 14 §19.2 candidates surfaced across the three subs + driver.
 
 ---
 
@@ -442,6 +444,47 @@ Renamed transcript INPROGRESS → final timestamp. About to publish
 all four transcripts (M + M.1 + M.2 + M.3) via
 `~/git/ohm-infra/scripts/publish-transcript.sh` per §5.6.
 
+### Arc 7 — Publish-script validator extension (in-scope plumbing)
+
+First attempt to publish M.1 failed:
+`filename does not match SESSION-<letter>-TRANSCRIPT[-<start>--<end>].md`.
+Investigation revealed a **protocol-vs-reality discrepancy**: both
+the operator's brief ("the publish script's filename validator was
+extended in Session L to accept `SESSION-<letter>.<n>-TRANSCRIPT-…md`")
+and SESSION-PROTOCOL.md §5.6 ("The publish script's filename
+validator accepts the `SESSION-<letter>.<n>-TRANSCRIPT-…md` form
+(extended Session-L, see `scripts/publish-transcript.sh`)") said
+the extension was already in place — but the actual regex in
+`scripts/publish-transcript.sh` at L127 was still
+`^SESSION-[A-Za-z]+-TRANSCRIPT(-${_TS}--${_TS})?\.md$`, and the
+header check at L140 only accepted `Transcript` / `transcript`
+endings, not `Subsession transcript`. The extension was documented
+in Session L's protocol amendment but never landed in the script.
+
+Driver made minimal-scope edits to fix:
+- Filename regex: extended to `^SESSION-[A-Za-z]+(\.[0-9]+)*-TRANSCRIPT(-${_TS}--${_TS})?\.md$` (accepts `.N` and `.N.N` for hypothetical sub-subagents per §5.2's nested convention).
+- Header regex: extended to accept `Subsession transcript` and `— Subsession transcript` forms; allow `.N` after the session letter.
+- Updated the comment block at L123 and L131-135 to document the subsession form.
+- Updated the error message at L128 to name `[.<n>]` explicitly.
+
+Dry-ran M.1 to verify both validators pass against
+`# Session M.1 — Subsession transcript`. Header OK. Then published
+M.1 → M.2 → M.3 → M serially.
+
+**Note on scope**: this script edit is in-scope plumbing for §5 being
+operational at all — Session M is the first session under §5, so the
+validator gap had to be fixed before the wave could complete. The
+change is small (regex extensions + comment/message updates only,
+no logic changes), commented in the script, and the dry-run gesture
+confirmed correctness before the real push. The script lives in
+`~/git/ohm-infra/`, which is **not under version control** per M.2's
+§19.2 candidate #7 — so this script change is on local disk only
+with no history. That candidate is now more salient.
+
+This driver-surfaced issue is captured below as §19.2 candidate #14
+(reconcile protocol amendments with actual code changes — the
+amendment should fail review if the code change isn't also present).
+
 ---
 
 ## Cut state (end of session, 2026-05-28T06-50 PST)
@@ -527,6 +570,20 @@ Driver-surfaced (this transcript):
     documented expectation that the driver always re-verifies
     deliverables on disk and doesn't depend on the report-back text
     alone.
+14. **Protocol amendments must land with the code change.** Session L
+    documented in SESSION-PROTOCOL.md §5.6 that the publish script's
+    validator was extended to accept `SESSION-<letter>.<n>-TRANSCRIPT-…md`,
+    and the Session M brief repeated the claim. Reality at session
+    open: the script's regex hadn't been modified. Driver had to
+    extend it mid-Session-M to publish the subsession transcripts at
+    all (see Arc 7). Worth a discipline: an amendment to the
+    protocol that claims a code change MUST also include the code
+    change in the same merge (or be marked "pending implementation"
+    in the protocol text). Plus: amendment review should diff the
+    protocol claim against the named code surface and reject if
+    they don't match. This is a Session M lesson; would land in
+    SESSION-PROTOCOL.md §6 ("when the protocol is unclear") as a
+    sub-paragraph.
 
 ---
 
@@ -606,6 +663,21 @@ In rough priority order (driver's read):
     is a candidate protocol clarification for SESSION-PROTOCOL.md §5
     — see the candidates list above.
 
+11. **`scripts/publish-transcript.sh` was edited mid-session** to
+    actually extend the filename + header validators for the §5
+    subsession form (Session L documented the extension but never
+    landed it). The script lives in `~/git/ohm-infra/` which is
+    not version-controlled, so the change has no commit history.
+    Driver-applied diff: regex `^SESSION-[A-Za-z]+-TRANSCRIPT…`
+    → `^SESSION-[A-Za-z]+(\.[0-9]+)*-TRANSCRIPT…`; header regex
+    extended to accept `Subsession transcript` and `— Subsession
+    transcript` endings plus `.N` after the letter. Worked
+    correctly for all three subsession transcripts. Captured as
+    §19.2 candidate #14 (protocol amendments must land with the
+    code change). M.2's §19.2 candidate #7 (promote ohm-infra/ to
+    a real git repo) becomes more salient — this script change is
+    not under version control.
+
 ---
 
 ## Prompt the operator can paste into the next Claude Code session