I read this as a code-quality review - I’ll inspect the bound candidate and wheel/seal evidence, then report only blocking findings or PASS.


I read this as a candidate/seal review - I audited bindings, evidence, and cleanup safety.

**BLOCKED - P1 cleanup integrity flaw**

`cleanup_controller.py:44` performs one unchecked `os.write(fd, raw)` in `atomic()`. POSIX permits short writes; the controller fsyncs and renames a truncated archive payload, then proceeds to disable the customer and patch config without validating the archived bytes.

This can lose the only pre-mutation copies of `customers/registry.json` and `config.yaml`, defeating the archive-first/rollback guarantee under I/O pressure. The tests do not inject a partial write.

The Hermes/profile wheel hashes, candidate verifier, focused bootstrap test, and independent verification of the already-created archive all pass, but they do not cover this failure mode.


I read this as a re-review of the v4 remediation - I’ll validate the immutable bindings, inspect the write/rollback path and tests, then run only read-only verifiers.


I read this as a v4 remediation re-review - I validated the fix, immutable bindings, and read-only verification.

**PASS**

The prior P1 is fixed: `write_all()` loops through partial writes, retries `InterruptedError`, rejects invalid counts, and `atomic()` unlinks failed temps before rename.

Verified:
- Controller hash `7750425a...`; v4 seal `188e9e630...`.
- 12/12 regression tests pass, including v3 truncation vs v4 exact-write and archive-failure/no-mutation.
- Seal verifier passed; independent verifier passed all 84 checks.
- V3 seal/archive remain unchanged; cleanup replay is prohibited and did not occur.
- PID `591348` is absent.

Remaining blocking findings: none.