@@ -143,8 +143,8 @@ first-contract CLI smoke against the unpacked `modal` binary. The language CLI
 revision may be the exact provenance revision or a longer matching hex prefix
 for the same commit; expected revisions must be full commit hashes or Git-style
 short hashes of at least seven lowercase hexadecimal characters. The producer
-and downloaded-artifact verifier both reject uppercase expected revision tokens
-before replay evidence can pass. Set
+and downloaded-artifact verifier both reject uppercase or overlong expected
+revision tokens before replay evidence can pass. Set
 `MODAL_ONBOARDING_ARCHIVE_EXPECT_REV=<commit>` when release evidence must fail
 if the built `modal` binary is stale or came from a different source revision.
 The `.github/workflows/onboarding-release-archive.yml` workflow wires this into
@@ -356,8 +356,8 @@ The producer-side archive smoke and the downloaded-artifact verifier both
 accept exact or matching-prefix hex revision markers for the same commit before
 claiming same-revision first-contract replay, and both reject expected or
 same-revision language CLI revision tokens shorter than seven hexadecimal
-characters. They also reject uppercase expected revision tokens before producer
-or downloaded-artifact replay evidence can pass. The producer-side archive
+characters. They also reject uppercase or overlong expected revision tokens
+before producer or downloaded-artifact replay evidence can pass. The producer-side archive
 smoke now also independently enforces
 the same single-line `modality` prefix and supported-marker shape with no other
 parenthesized version notes, duplicate revision markers, bare `@...` markers,
 
@@ -217,7 +217,7 @@ consumer. Set
 `MODAL_ONBOARDING_ARCHIVE_EXPECT_REV=<commit>` when release evidence must fail
 if the built `modal` binary is stale or came from a different source revision.
 The producer and downloaded-artifact verifier both reject uppercase expected
-revision tokens before replay evidence can pass.
+or overlong revision tokens before replay evidence can pass.
 The archive check also runs the downloaded-artifact verifier against the
 generated archive directory, which simulates the GitHub Actions artifact
 consumer path by requiring exactly one `modal-*.tar.gz`, its matching detached
@@ -312,7 +312,8 @@ independently enforces the same single-line `modality` prefix and
 supported-marker shape with no other parenthesized version notes, duplicate
 revision markers, bare `@...` markers, or trailing marker text before local first-contract replay.
 It also rejects uppercase expected revision tokens before producer or
-downloaded-artifact replay evidence can pass.
+downloaded-artifact replay evidence can pass, and rejects overlong expected
+revision tokens before either replay entry point can pass.
 When a regular
 non-symlink executable
 `MODALITY_BIN` is available, the producer smoke also runs
 
@@ -107,7 +107,7 @@ command for artifact consumers in the canonical emitted order. Set
 `MODAL_ONBOARDING_ARCHIVE_EXPECT_REV=<commit>` when release
 evidence must fail if the built `modal` binary is stale or came from a
 different source revision. The producer and downloaded-artifact verifier both
-reject uppercase expected revision tokens before replay evidence can pass.
+reject uppercase or overlong expected revision tokens before replay evidence can pass.
 
 To verify a downloaded GitHub Actions artifact before unpacking or trusting it:
 
@@ -201,7 +201,7 @@ archive smoke applies the same language-CLI version-shape check before local
 first-contract replay, including direct producer-side negatives for duplicate
 revision markers, bare `@...` markers, and trailing marker text.
 The producer and downloaded-artifact verifier also reject uppercase expected
-revision tokens before replay evidence can pass.
+or overlong revision tokens before replay evidence can pass.
 
 The archive producer selects the source checkout revision before falling back
 to any embedded `modal --version` revision marker, and its negative corpus
 
@@ -1044,6 +1044,23 @@ $negative_output
 EOF
   exit 1
 fi
+long_expected_revision="${source_revision}0"
+negative_output="$(
+  MODAL_ONBOARDING_ARTIFACT_EXPECT_REV="$long_expected_revision" \
+    "$ROOT_DIR/tests/cli/check-modal-release-artifact-download.sh" "$ARCHIVE_DIR" 2>&1
+)" && {
+  echo "release artifact verifier accepted an overlong expected revision" >&2
+  exit 1
+}
+if ! grep -Fq "release artifact expected source revision is not a lowercase hex commit token" <<<"$negative_output"; then
+  cat >&2 <<EOF
+release artifact verifier rejected the overlong expected revision for the wrong reason
+expected: release artifact expected source revision is not a lowercase hex commit token
+actual:
+$negative_output
+EOF
+  exit 1
+fi
 upper_expected_revision="$(printf '%s' "${source_revision:0:7}" | tr '[:lower:]' '[:upper:]')"
 negative_output="$(
   MODAL_ONBOARDING_ARTIFACT_EXPECT_REV="$upper_expected_revision" \
@@ -4076,6 +4093,22 @@ $negative_output
 EOF
   exit 1
 fi
+negative_output="$(
+  MODAL_ONBOARDING_ARCHIVE_EXPECT_REV="$long_expected_revision" \
+    "$ROOT_DIR/tests/cli/check-modal-release-archive-readiness.sh" 2>&1
+)" && {
+  echo "release archive readiness accepted an overlong producer expected revision" >&2
+  exit 1
+}
+if ! grep -Fq "release archive expected source revision is not a lowercase hex commit token" <<<"$negative_output"; then
+  cat >&2 <<EOF
+release archive readiness rejected overlong producer expected revision for the wrong reason
+expected: release archive expected source revision is not a lowercase hex commit token
+actual:
+$negative_output
+EOF
+  exit 1
+fi
 negative_output="$(
   MODAL_ONBOARDING_ARCHIVE_EXPECT_REV="$upper_expected_revision" \
     "$ROOT_DIR/tests/cli/check-modal-release-archive-readiness.sh" 2>&1
 
@@ -80,7 +80,8 @@ required_patterns=(
   "expected revisions must be full commit hashes or Git-style"
   "short hashes of at least seven lowercase hexadecimal characters"
   "producer"
-  "downloaded-artifact verifier both reject uppercase expected revision tokens"
+  "downloaded-artifact verifier both reject uppercase or overlong expected"
+  "revision tokens"
   "before replay evidence can pass"
   "checks the unpacked help surface"
   "first-contract CLI smoke against the unpacked \`modal\` binary"
@@ -375,8 +376,8 @@ required_patterns=(
   "both reject expected or"
   "same-revision language CLI revision tokens shorter than seven hexadecimal"
   "characters"
-  "They also reject uppercase expected revision tokens before producer"
-  "or downloaded-artifact replay evidence can pass"
+  "They also reject uppercase or overlong expected revision tokens"
+  "before producer or downloaded-artifact replay evidence can pass"
   "uppercase revision markers are rejected"
   "smoke now also independently enforces"
   "same single-line \`modality\` prefix and supported-marker shape with no other"
@@ -783,6 +784,16 @@ if ! grep -Fq 'release artifact verifier accepted a too-short expected revision'
   echo "release archive producer should prove too-short expected revisions are rejected" >&2
   exit 1
 fi
+if ! grep -Fq 'release artifact verifier accepted an overlong expected revision' \
+  "$ROOT_DIR/tests/cli/check-modal-release-archive-readiness.sh"; then
+  echo "release archive producer should prove overlong artifact expected revisions are rejected" >&2
+  exit 1
+fi
+if ! grep -Fq 'release archive readiness accepted an overlong producer expected revision' \
+  "$ROOT_DIR/tests/cli/check-modal-release-archive-readiness.sh"; then
+  echo "release archive producer should prove overlong producer expected revisions are rejected" >&2
+  exit 1
+fi
 if ! grep -Fq '[[ ! "$modality_revision" =~ ^[0-9a-f]{7,40}$ ]]' \
   "$ROOT_DIR/tests/cli/check-modal-release-artifact-download.sh"; then
   echo "release artifact verifier should reject too-short smoke modality revisions" >&2