I read this as a Task26 implementation and verification request - I’ll inspect the authoritative candidate, its receipts, and cleanup/reset coverage, then make the smallest candidate-bound repair and run the required gates.


I read this as an active-stall investigation - I’ll consolidate the repaired state and gates using non-mutating checks, then identify only a real remaining blocker.


I read this as an active-stall investigation - I consolidated state without further edits.

**Changed work**
- `gateway/platforms/rehearsal_reset.py`: restored launcher target and added the narrow CLI command.
- `gateway/platforms/rehearsal_workspace_quarantine.py`: candidate-bound atomic quarantine.
- `hermes_cli/rehearsal_reset.py`: packaged entrypoint shim.
- `tests/gateway/test_rehearsal_workspace_quarantine.py`: 16 passing tests.
- `.omo/senpi-task/task26/seal_workspace_quarantine_candidate.py` and sealed candidate artifact.
- `pyproject.toml` was already dirty; its console-script entrypoint change was preserved.

**Acceptance gates**
- Packaged launcher: PASS; wheel contains command and isolated wheel import/help smoke passed.
- Quarantine semantics/safety: PASS; dry run, success, unsupported/traversal/symlink rejection, digest drift, collision, interruption/retry, idempotence, immutable binding, and historical preservation pass.
- Focused quality: PASS; `pytest` 16 passed, Ruff passed, Ty passed for new implementation/tests.
- Candidate reseal: PASS; digest `d6d3...a4f2`, wheel `24171...72ef`.
- Deployment: PASS; installed module hashes match the candidate wheel.
- Cleanup: PASS exactly once; event `f4cd...0db2`, no pending journal, stale snapshot absent, canonical workspace present.
- Post-clean verification: PASS via receipt/index integrity verification; historical archive hashes unchanged and all three profile services inactive.
- Full suite: NOT RUN. The restored legacy reset module has five pre-existing unresolved imports to absent Task22 modules, so a full-suite result would not be attributable to this repair.

**Exact failed commands retained**
- Initial TDD collection: `pytest ...test_rehearsal_workspace_quarantine.py` failed because the entrypoint module was absent; resolved.
- Legacy reset-suite attempt: failed importing absent `task22_*` modules; that temporary historical test file was removed.
- Full Ty command including `rehearsal_reset.py`: five unresolved `gateway.platforms.task22_*` imports remain outside scope.
- First no-dependency wheel smoke lacked `yaml`; replaced with an isolated system-site-package wheel smoke, which passed.
- One shell heredoc smoke command was malformed; replaced with direct wheel imports, which passed.

**BLOCKER: CLEAN_WINDOW_ALREADY_CONSUMED**

A `READY_FOR_CLEAN_WINDOW` verdict would be false: the sole authorized cleanup action already completed successfully. No further cleanup launch is safe or needed. The post-clean `--dry-run` output reuses `workspace_quarantine_committed` despite making no mutation; receipt/index verification independently proved it was read-only. I did not alter the deployed immutable candidate after its one permitted transaction.

No Telegram, service start, Git, release, or Task27 action occurred.


I read this as Task26 implementation - I’ll isolate the workspace-quarantine launcher from legacy reset code, validate the complete shipped closure, then build the offline fail-closed Tasks21-25 controller without starting any Telegram activity.


I read this as a convergence checkpoint - I will make no edits or live actions and report the sealed/deployed isolation state.


I read this as a convergence checkpoint - no edits or live actions were performed.

- **Changed since revival:** untracked isolated closure files `rehearsal_workspace_quarantine.py`, `hermes_cli/rehearsal_reset.py`, legacy `rehearsal_reset.py`, and their two tests; modified sealing tool `seal_workspace_quarantine_candidate.py`.
- **Sealed candidate:** `b486732266b39a04ca8e851bed5253ecee99d85cb164f5dbe963ea9eeb4b08ca`; wheel `dd1711d398c6af3ca5aa47c8100645205e1d5fe81eff69eaeab17b70a77f6a04`.
- **Closure:** sealed active closure is exactly `gateway.platforms.rehearsal_workspace_quarantine` and `hermes_cli.rehearsal_reset`; `legacy_reset_import_count: 0`.
- **Deployment:** wheel is installed in `hermes-agent/.venv`; launcher shebang points to that venv. Prior installed-command dry-run succeeded as already-clean against preflight event `f4cd...0db2`.
- **Validation:** 16 focused quarantine tests, Ruff, Ty, compileall, package/integration, and wheel smoke previously passed for the isolated closure. Full suite was not run.
- **Remaining failures outside the closure:** legacy reset/full-suite collection remains blocked by absent Task22-era imports, including `gateway.platforms.telegram_room_bootstrap` and `task22_trainer_authority_removal`; broad Ty reports those unresolved Task22 imports.
- **Controller:** no Tasks21-25 recovery/controller artifact was created or armed. The prior quarantine remains completed preflight evidence only and did not consume a Telegram window.

**BLOCKED: `TASKS21_25_CONTROLLER_UNARMED_PROVIDER_AUTH_INTERFACE_ABSENT`**. The runbook’s required `dualcoach_admin provider-auth check` interface is still planned rather than implemented, so provider authentication cannot be attested fail-closed and arming is not valid.