diff --git a/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java b/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java
index 657c265..0079806 100644
--- a/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java
+++ b/applet/src/main/java/com/dangerousthings/aliro/CoseVerifier.java
@@ -40,9 +40,10 @@ import javacard.security.Signature;
 final class CoseVerifier {
 
     /** Maximum supported COSE_Sign1 payload length. The Aliro Access
-     *  Document fits comfortably under this; we size the Sig_structure
-     *  working buffer for it. */
-    static final short MAX_PAYLOAD = (short) 512;
+     *  Document's inner COSE payload is ~188 B today; we cap at 256 to
+     *  keep the Sig_structure working buffer inside the J3R452 transient
+     *  pool (~3,120 B) once the other applets' allocations are summed in. */
+    static final short MAX_PAYLOAD = (short) 256;
 
     /** Maximum supported protected bstr length. Aliro IssuerAuth uses a
      *  single {alg: ES256} map (3 bytes), but we cap at 32 for slack. */
@@ -89,11 +90,13 @@ final class CoseVerifier {
         Secp256r1Params.seedPublic(issuerPubKey);
         ecdsaVerifier = Signature.getInstance(Signature.ALG_ECDSA_SHA_256, false);
         // Sig_structure size = prefix(12) + prot_hdr(<=3) + prot_bytes(<=32)
-        //                    + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=512)
-        // DER sig max = 2 + 2 + 33 + 2 + 33 = 72.
-        // Round up to keep arithmetic simple.
+        //                    + ext_aad(1) + pl_hdr(<=3) + pl_bytes(<=256)
+        // DER sig max = 2 + 2 + 33 + 2 + 33 = 72. Total ~381. Round to 384.
+        // Was 768 (M2A.2) -- blew the J3R452 transient pool budget once all
+        // applets' allocations summed in (~3,120 B cap). M2G.2 verdict run
+        // tripped 0x6FC4 from AliroCrypto.expandScratch.
         scratch = JCSystem.makeTransientByteArray(
-            (short) 768, JCSystem.CLEAR_ON_DESELECT);
+            (short) 384, JCSystem.CLEAR_ON_DESELECT);
     }
 
     /**
diff --git a/docs/verdicts/2026-06-12-m2-pcsc-verdict.log b/docs/verdicts/2026-06-12-m2-pcsc-verdict.log
new file mode 100644
index 0000000..6bbdd36
--- /dev/null
+++ b/docs/verdicts/2026-06-12-m2-pcsc-verdict.log
@@ -0,0 +1,13 @@
+Using reader: NXP PR533 (3.70) 00 00
+Connected. ATR: 3b8a80014a444e4752665334353258
+Loaded trust artifacts from /home/work/aliro-trust
+RESULT: OK — applet round-trip on real hardware.
+  0x5A credential_PubK: 65B
+  0x9E UD signature: 64B
+  0x5E signaling_bitmap: 0x0005
+  APDU latencies (ms):
+    select    23.1
+    auth0    667.1
+    auth1   3258.3
+    total   3948.4
+STEP-UP M2: OK — M2 step-up verified (EXCHANGE + ENVELOPE Access Document round-trip)