# Task26 local strict-rerun retention control

This append-only package preserves the existing v3 archive and cleanup history unchanged.
It stores a byte-exact, content-addressed copy under `retention-store/objects/9f5d7284...`,
then uses a network-disabled, no-pull local container to make every copied inode root-owned,
read-only, and ext4 immutable. POSIX mode alone is never accepted as retention proof.

Both strict rehearsal and cleanup must pass `strict_rerun_controller.py` with the sealed
`retention-proof.json`. Missing, malformed, hash-drifted, owner-drifted, mode-drifted, or
non-immutable proof fails before the supplied action callback. The completed one-use v3
cleanup remains non-replayable.

Retention starts at `2026-08-17T00:00:00Z` and ends at `2033-08-17T00:00:00Z` for strict-rerun
audit and incident reconstruction. The metadata binds candidate `4a6c7ee5...`, lifecycle root
`fdcfb1ef...`, lifecycle seal `50e7556e...`, v3 seal `84d937ef...`, v4 seal `188e9e63...`, and
all 172 source archive entries.

Verification command:

```sh
python3 retention_control.py verify --proof retention-store/objects/9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635/retention-proof.json
```

Strict rehearsal and cleanup preflights:

```sh
python3 strict_rerun_controller.py strict-rehearsal-preflight --retention-proof retention-store/objects/9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635/retention-proof.json
python3 strict_rerun_controller.py cleanup-preflight --retention-proof retention-store/objects/9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635/retention-proof.json
```