I read this as independent verification - I will inspect the authoritative diff/contracts, run only the requested checks and isolated driver without editing tracked content, then report PASS/FAIL.


I read this as independent verification - the initial commands ran from the task directory rather than the target repository, so I am now collecting the repository-local diff, authority contracts, and immutable baselines.


I read this as independent verification - the target worktree has broad pre-existing drift; `3b42723d` is absent from this repository, so I will preserve that as a potential mandatory FAIL while completing the requested behavioral checks.


I read this as independent verification - two required baselines are already nonconforming: the named regression test differs from `HEAD`, and no local repository contains candidate `3b42723d`; I will now run the specified checks in an isolated temporary environment.


I read this as independent verification - I will execute the exact named test, full requested test targets, lint/format/type checks, and a temporary-only authority-file driver; all runner state and test homes are outside the repository.


I read this as independent verification - behavioral coverage passed, but the required format check and repository type check failed; I will now collect post-run drift/non-touch evidence and isolate diagnostics for `gateway/status.py`.


I read this as independent verification - the post-run target hashes are unchanged, but the first cleanup probe raced the file-specific type check and detected a gateway-lookalike; I will identify it read-only and recheck cleanup after all commands have exited.


I read this as independent verification - final repository drift is unchanged and temporary sandboxes are gone; I will make one non-self-matching process probe to close the cleanup evidence.


I read this as independent verification - **FAIL**: mandatory candidate/test-baseline requirements are inconclusive/nonconforming, and format/type checks fail.

- Branch: `feature/dual-coach-lifecycle`; HEAD `0dc0f228dcec8fa54430882daf72e901d6a89f79`.
- `3b42723d` is absent from every local repository/ref/object checked. Its `gateway/status.py` cannot be compared, so “no longer matches candidate” and reseal cannot be confirmed.
- Named test is **not unchanged from HEAD**:
  - current function SHA-256: `ae985645...`
  - HEAD function SHA-256: `776fd0e8...`
  - expectation changed from `assert not pid_path.exists()` to `assert pid_path.exists()`.

Checks run in isolated `/tmp` homes with `-p no:cacheprovider`:
```text
python -m pytest ... test_status.py::TestGatewayPidState::test_get_running_pid_rejects_live_non_gateway_pid
=> 1 passed

python -m pytest ... tests/gateway/test_status.py
=> 73 passed

python -m pytest ... tests/hermes_cli/test_gateway_runtime_health.py
=> 4 passed

python -m pytest ... tests/gateway/test_planned_stop_watcher.py
=> 11 passed
```
All emitted two pytest config warnings because plugin autoload was disabled.

Diagnostics:
```text
ruff 0.15.10 check gateway/status.py
=> All checks passed

ruff 0.15.10 format --check gateway/status.py
=> FAIL: 1 file would be reformatted

ty 0.0.21 check
=> FAIL (exit 101): Found 15520 diagnostics; fatal incomplete-analysis warning

ty 0.0.21 check gateway/status.py
=> PASS
```

Isolated manual driver: **PASS**
- legacy numeric PID preserved
- malformed authority preserved
- symlink/untrusted authority preserved
- private stale JSON PID + sibling lock removed
- `cleanup_stale=False` preserved both files
- live process with active lock and matching PID/start/boot/home/cmdline returned its PID
- driver child was terminated/reaped; final gateway-lookalike matches: `0`; temporary sandbox count: `0`.

Authority contract observed: authority cleanup only unlinks a private, current-UID, single-link, regular `0600` file; untrusted paths fail closed.

Non-touch evidence:
- Pre/post target hashes identical:
  - `gateway/status.py`: `8641bae4540dcadec0f80a3d97b1a1013ab36f3cb1b4920027d70cae1d1d308c`
  - `tests/gateway/test_status.py`: `1976b3530484b105704fdf2bcf1c6302ec7416fcec33f675e515177ef7447c5d`
  - runtime-health: `3ee7bdbe...`
  - planned-stop: `f6145234...`
- Pre/post porcelain snapshot hash unchanged: `fa6ec113...`
- Pre/post `gateway/status.py` diff hash unchanged: `8a8978de...`
- No source, profile, runtime, candidate, archive, Git, network, or external-service action was performed.


I read this as baseline-audit correction - I will use the immutable evidence tree and task hashes as authority, run its verifier with only temporary cache state, then reclassify the PID-fix verdict without editing anything.


I read this as baseline-audit correction - the evidence verifier authenticates the immutable candidate itself, while I will separately compare its executable closure against current source bytes and task-local pre/post records.


I read this as baseline-audit correction - the closure has exactly one current-source mismatch (`gateway/status.py`); I will now bind the shared test to its closure entry and verify the candidate/current source and formatter delta directly.


I read this as baseline-audit correction - the immutable candidate verifies and the PID fix is the closure’s sole source delta; I will record final hashes and temporary-cache cleanup before issuing the corrected verdict.


I read this as baseline-audit correction - **PID fix PASS; reseal REQUIRED.**

**Immutable candidate verification**
```text
EVIDENCE=/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-repaired-archive-successor-3b42723d0e8256351defdf31958f9ade795f80a7be456529740949c87875d527
env HOME=/tmp/... XDG_CACHE_HOME=/tmp/... PYTHONDONTWRITEBYTECODE=1 \
  /home/cube/miniconda3/bin/python -B "$EVIDENCE/verify_candidate.py" \
  "$EVIDENCE/verifier-input.json"
```
Result: `PASS`
- candidate digest: `3b42723d0e8256351defdf31958f9ade795f80a7be456529740949c87875d527`
- manifest: `c6d10ff1...`
- checkpoint: `6f05fb3a...`
- candidate pre/post status snapshots are byte-identical: `ca1ce270...`

**Exact current closure drift: 1 mismatch**
```text
gateway/status.py
candidate: 7a04d81facfd29360a096c1233d2afd015e1933c223adcbf7946c087ca9c5115 (60,499 bytes)
current:   8641bae4540dcadec0f80a3d97b1a1013ab36f3cb1b4920027d70cae1d1d308c (60,653 bytes)
```
The wheel source confirms the sole delta is the Gate20 fix:
```diff
-    if not lock_active and not identity_unknown:
+    # Preserve unvalidated authority files fail-closed; only a validated
+    # primary record can authorize stale cleanup.
+    if not lock_active and not identity_unknown and primary_record is not None:
```
Therefore the candidate no longer closes over current source and **must be resealed**.

**Correct test baseline**
```text
tests/gateway/test_status.py
candidate closure: 1976b3530484b105704fdf2bcf1c6302ec7416fcec33f675e515177ef7447c5d (59,025 bytes)
current:           1976b3530484b105704fdf2bcf1c6302ec7416fcec33f675e515177ef7447c5d (59,025 bytes)
```
The test is unchanged relative to the task/candidate baseline. The prior `HEAD` comparison was invalid for this audit.

**Functional verification retained**
- focused regression: `1 passed`
- `tests/gateway/test_status.py`: `73 passed`
- runtime-health: `4 passed`
- planned-stop watcher: `11 passed`
- isolated authority driver: all legacy-preserve, malformed/symlink-preserve, validated-stale cleanup, `cleanup_stale=False`, and live authenticated identity branches passed.

**Baseline debt reclassification**
- `ruff check gateway/status.py`: PASS.
- `ruff format --check gateway/status.py`: one-file failure, but the immutable candidate source fails identically; formatting debt is pre-existing and outside the Gate20 hunk.
- repository `ty check`: exit 101, `15520` diagnostics/incomplete analysis; baseline debt.
- `ty check gateway/status.py`: PASS.

**Non-touch**
- Current source/test hashes above were unchanged before/after this correction.
- Working-tree fingerprints stayed `fa6ec113...` (porcelain) and `8a8978de...` (`gateway/status.py` diff).
- Temporary isolation directories: `0` remaining.
- No source, test, profile, runtime, candidate, archive, Git, network, or service edits/actions were performed.