diff --git a/packages/runtime/src/seed-loader.test.ts b/packages/runtime/src/seed-loader.test.ts
index 48d4984760..51cda6f0e4 100644
--- a/packages/runtime/src/seed-loader.test.ts
+++ b/packages/runtime/src/seed-loader.test.ts
@@ -1119,6 +1119,8 @@ describe('SeedLoaderService', () => {
 
       expect(result.success).toBe(true);
       expect(result.summary.totalErrored).toBe(0);
+      // One record ⇒ one write; a repeat here would be a double seed (#15607).
+      expect(engine.insert).toHaveBeenCalledTimes(1);
       expect(engine.insert).toHaveBeenCalledWith(
         'note',
         expect.objectContaining({ name: 'N1', author: 'usr_system' }),
@@ -1152,6 +1154,8 @@ describe('SeedLoaderService', () => {
 
       expect(result.success).toBe(true);
       expect(result.summary.totalErrored).toBe(0);
+      // One record ⇒ one write; a repeat here would be a double seed (#15607).
+      expect(engine.insert).toHaveBeenCalledTimes(1);
       expect(engine.insert).toHaveBeenCalledWith(
         'note',
         expect.objectContaining({ name: 'N1', author: null }),
@@ -1180,6 +1184,10 @@ describe('SeedLoaderService', () => {
       });
 
       expect(result.success).toBe(true);
+      // One record, mode 'insert' ⇒ exactly ONE engine write. Seed application is
+      // the very path where a doubled collect writes twice and stays green under
+      // `toHaveBeenCalledWith` (#15607).
+      expect(engine.insert).toHaveBeenCalledTimes(1);
       expect(engine.insert).toHaveBeenCalledWith(
         'note',
         expect.objectContaining({ org_label: 'org_123' }),
diff --git a/packages/services/service-storage/src/attachment-lifecycle.test.ts b/packages/services/service-storage/src/attachment-lifecycle.test.ts
index 5113a2b348..645e794046 100644
--- a/packages/services/service-storage/src/attachment-lifecycle.test.ts
+++ b/packages/services/service-storage/src/attachment-lifecycle.test.ts
@@ -418,6 +418,10 @@ describe('createSysFileReapGuard', () => {
       { id: 'f1', key: 'attachments/f1.bin', status: 'deleted', scope: 'attachments' },
     ]);
 
+    // ONE tombstoned row in ⇒ exactly ONE irreversible byte delete: the count IS
+    // the contract for a sweep that re-runs, and `toHaveBeenCalledWith` alone is
+    // satisfied by a repeat just as well as by a single call (#15607).
+    expect(s.delete).toHaveBeenCalledTimes(1);
     expect(s.delete).toHaveBeenCalledWith('attachments/f1.bin');
     expect(confirmed).toEqual(['f1']);
   });
@@ -467,6 +471,9 @@ describe('createSysFileReapGuard', () => {
       { id: 'f1', key: 'user/f1.png', status: 'deleted', scope: 'user', ref_object: null, ref_id: null },
     ]);
 
+    // One released field file, one open gate ⇒ exactly one byte delete; a second
+    // call would be a re-reap of a key already gone (#15607).
+    expect(s.delete).toHaveBeenCalledTimes(1);
     expect(s.delete).toHaveBeenCalledWith('user/f1.png');
     expect(confirmed).toEqual(['f1']);
   });
@@ -566,6 +573,8 @@ describe('createSysFileReapGuard', () => {
       { id: 'p1', key: 'user/p1.bin', status: 'pending' },
     ]);
 
+    // Best-effort cleanup of ONE abandoned upload — exactly one delete (#15607).
+    expect(s.delete).toHaveBeenCalledTimes(1);
     expect(s.delete).toHaveBeenCalledWith('user/p1.bin');
     expect(confirmed).toEqual(['p1']);
   });
diff --git a/packages/services/service-storage/src/lax-deviation-reclamation-gate.test.ts b/packages/services/service-storage/src/lax-deviation-reclamation-gate.test.ts
index 43759159c7..e52a8ee6b1 100644
--- a/packages/services/service-storage/src/lax-deviation-reclamation-gate.test.ts
+++ b/packages/services/service-storage/src/lax-deviation-reclamation-gate.test.ts
@@ -182,6 +182,10 @@ describe('the reclamation gate refuses to delete bytes while a deviation stands
     });
 
     expect(await guard('sys_file', [{ ...RELEASED_FIELD_FILE }])).toEqual(['f1']);
+    // The guard ran TWICE in this test: withheld first, authorised second. So the
+    // count is the whole point — 1 proves the withheld pass deleted nothing, and
+    // `toHaveBeenCalledWith` alone would pass just the same if it had (#15607).
+    expect(s.delete).toHaveBeenCalledTimes(1);
     expect(s.delete).toHaveBeenCalledWith('user/f1.png');
   });
 
@@ -201,6 +205,8 @@ describe('the reclamation gate refuses to delete bytes while a deviation stands
     // reach a lifecycle that never gated on the flag would be the borrowed-
     // evidence error in the other direction.
     expect(confirmed).toEqual(['a1']);
+    // One attachment-scope tombstone ⇒ exactly one byte delete (#15607).
+    expect(s.delete).toHaveBeenCalledTimes(1);
     expect(s.delete).toHaveBeenCalledWith('attachments/a1.bin');
   });
 });
diff --git a/packages/spec/src/shared/resilient-fetch.test.ts b/packages/spec/src/shared/resilient-fetch.test.ts
index 60c0573ac0..51e3386402 100644
--- a/packages/spec/src/shared/resilient-fetch.test.ts
+++ b/packages/spec/src/shared/resilient-fetch.test.ts
@@ -64,6 +64,9 @@ describe('resilientFetch', () => {
         const fetchImpl = scripted([[429, { 'retry-after': '2' }], 200]);
         const sleep = vi.fn(noSleep);
         await resilientFetch('http://x', {}, { fetchImpl, sleep, retries: 3 });
+        // One 429 ⇒ exactly ONE backoff. This is a retry path, where a doubled sleep
+        // is a real defect and `toHaveBeenCalledWith(2000)` cannot see it (#15607).
+        expect(sleep).toHaveBeenCalledTimes(1);
         expect(sleep).toHaveBeenCalledWith(2000);
     });