I read this as an authorized live cleanup execution - I’ll reconstruct the exact sealed lifecycle, build a new fail-closed successor without touching the stale controller, then run and independently verify the disabled archived rehearsal baseline.


The sealed lifecycle and live profile match the requested identifiers, and the dualcoachtest gateway is currently running. I’m now deriving the supported disable/reset contracts and exact authority set before creating the successor; the stale v2 controller remains read-only and will not be executed.


The current production contract supports direct disable via `checkin_cli.customer_admin disable`; it does not require rewriting lifecycle or owner ledgers. I’m implementing the successor so dry-run accepts the sealed enabled/running prestate, execution first commits a byte-exact archive, then uses that supported disable command, `apply_patch` for the sole config change, graceful gateway control, and archive-backed rename reset with rollback.


The successor is now sealed to controller `9efa3396…`, contract `37f55dfd…`, and one-use permission `39d8c50f…`; 8 deterministic tests, Ruff, compile, LSP errors, and the prior lifecycle verifier all pass. I’m beginning the zero-mutation live dry-run, after which the identical pinned command will execute once.


The dry-run failed closed with zero mutation because this systemd version does not preserve the requested `--value` property order. The live PID, state, config, and lifecycle remain unchanged. I’m correcting the successor to parse named `key=value` output, then resealing its one-use permission and rerunning validation.


The final resealed dry-run passes with 67 byte-pinned authority files, zero mutation, no archive creation, the exact ACTIVE lifecycle and message 232, and unrelated-profile baseline `258fd0ff…`. I’m executing the one-use transition now; the controller will retain the archive even if any later check fails and will restore the prestate on failure.


Execution passed: the archive committed before mutation; canonical disable produced registry hash `3235f712…`; the config gate is now false with the other three flags unchanged; no post-disable customer delivery was observed; and the service is inactive/dead with MainPID 0. The old verifier’s live-state mode now correctly rejects the intentionally cleaned live profile, so final verification uses its inventory-only mode to prove the sealed evidence bytes themselves remain unchanged.


I read this as completion reporting - the authorized Task26 cleanup is finished and independently verified.

- **Result:** `PASS_VERIFIED_DISABLED_ARCHIVED_CLEAN`
- **Blocker:** none

### Successor controller

- Root: `.omo/evidence/task26/task26-post-lifecycle-cleanup-v3-4a6c7ee5-st_01a00e50`
- Controller SHA-256: `aad9f6934833667e78d2d1752f2071971707206ee19d15d24e884136debff15a`
- Contract: `37f55dfda214b7378f999872660fb6aad733d9f0cca41ca3a36008c529436c84`
- One-use permission: `d190976fdaa765194d1ad2947b5a651b2aa59a459197376b3bdf360c2de1d470`
- Tests: 8 passed; Ruff PASS; compile PASS; LSP errors 0
- Final dry-run: PASS, mutations `0`, 67 authority files
- Dry-run receipt: `c2b1b90b6a4be213fa167c498fc7dc27e2a18769f518f724df3ac456573bb16c`

The stale `8b03fa…` controller was neither executed nor modified.

### Archive and cleanup

- Archive: `/home/cube/.hermes/profiles/dualcoachtest/data/post-lifecycle-cleanup-archives/task26-current-4a6c7ee5-20260817`
- Archive root SHA-256: `9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635`
- All 140 archive files are mode `0600`.
- Cleanup receipt: `8553980813330dd2fdb8bdc062850d51a99eb682ce87eb3ed15ab2ddec773e92`
- Canonical disable receipt: `c40b1a24788242b152823a713c543352217e962269b816d7be38b54048d11573`
- Disabled registry hash before archival reset: `3235f71215de1e5ed257902eae622ebae53e70d65dbc7f53a7f86de6739eb770`
- Poststate receipt: `a36c53b4c20c9c24083b0605004ab8bce1efdd78d2964de1f816bd24e36bb229`

Archived history remains byte-exact:

- Delivery ledger: `c1c99d62…`, exactly one `sent_audited` row, message `232`
- ACTIVE bootstrap ledger: `bfae49a6…`
- Lifecycle seal remains `50e7556…`; inventory-only verifier PASS

### Clean poststate

- Registry/customer data/onboarding/owner-action authorities: absent
- Future jobs/publications: `0`
- Gateway: `inactive/dead`, `MainPID=0`
- Gateway state, locks, PID files, state DB artifacts: absent
- Profile gateway processes: none
- Trainer artifacts: none
- Config mode: `0664`
- Config SHA-256: `f93106b16643227e2ef9dec67a5bbd497e1d353e779da62287898a087071af87`
- Flags: `enabled=true`, `delivery_enabled=false`, `activation=false`, `delivery=false`
- Post-disable delivery events: `0`
- Unrelated physique-coach profile unchanged: `258fd0ffd1fdcf5937d131244dab217691c945deb7836c14dc101aca155fe247`
- Token/provider authorities remained at their pinned hashes.

### Verification and seal

- Controller verifier: PASS, 67 archived entries
- Independent verifier: PASS, 79 checks
- Successor inventory: `5a07b9a998cb673bd1cdae27bce5df69e6a93a37b9144149cb48989bef4fc6d2`
- Evidence root: `4c455387375632d77112cc80b73b921f9acb867991b11664e9fa0acb4a4669d4`
- `SEAL.json`: `84d937ef67c1517bfdbca4cabce9fb4bfbe39aa1165458bb3aedd14decc4bff0`
- Seal verifier: PASS, 64 checks

Exact top-level commands are preserved in:

- `exact-dry-run-final-command.txt`
- `exact-execute-command.txt`
- `exact-verify-command.txt`
- `exact-independent-verify-command.txt`

Mutation commands recorded in receipts:

```text
python -m checkin_cli.customer_admin --registry ~/.hermes/profiles/dualcoachtest/customers/registry.json disable task26_live_2e_r2_20260815_8527916639
/tmp/apply_patch  # delivery_enabled: true -> false
python -m hermes_cli.main --profile dualcoachtest gateway stop
```

No restart was required: the gateway remained running after canonical disable while the journal monitor was armed, then stopped truthfully with no customer delivery.