I read this as a test-first implementation task - I’ll inspect the profile source contracts and tests, add focused archive/cleanup modules and RED coverage, then run the full requested verification without touching Golden Path or Git.


I’ve mapped the existing authority lock, registry withdrawal semantics, customer data namespace, and delivery terminal states. I’m starting with focused contract tests, then will implement the cleanup transaction in small modules while keeping `customer_admin.py` untouched.


The RED suite now passes against the focused transaction implementation. I’m at verification: checking module-size constraints, static diagnostics, the complete profile suite, and a real temporary-profile run; any failures will be separated into change-caused versus pre-existing.


I read this as completed implementation - I’ll report delivered contracts, verification, and remaining repository-wide gaps.

Implemented source-ready customer cleanup contracts.

- 3 production APIs:
  - `archive_customer_cleanup`
  - `resume_customer_cleanup`
  - `post_cleanup_authority_inventory`
- 6 files changed:
  - 4 focused production modules, all under 250 LOC
  - package exports
  - 11 new contract tests
- Supports:
  - single private authority lock and operation ID
  - forward-only four-phase digest-chained journal
  - byte-verified, private frozen archive with bound manifest
  - concurrent/idempotent callers and crash resume
  - pending/unknown authority blocking
  - symlink, hardlink, permission, traversal, and cross-customer rejection
  - independent terminal authority inventory
  - retained audited delivery/activation history

Verification:

- Initial RED run failed on missing module as expected.
- Full suite: **731 passed**
- Focused cleanup/admin suite: **139 passed**
- New cleanup tests: **11 passed**
- Changed-file Ruff: clean
- Changed-file ty: clean
- `compileall`: clean
- Manual temporary-profile driver: committed, duplicate operation matched, archive verified, terminal inventory true
- Repository-wide Ruff still has **617 pre-existing findings**
- Repository-wide ty still has **1272 pre-existing diagnostics**

No Golden Path scripts, Git state, live services, plans, todos, or unrelated source were modified.


I read this as an exact audit report - I’ll list paths and commands only, with no edits.

Working directory:

```text
/home/cube/.cache/task26-strict-successor-1786976146/src-p
```

Production files changed:

```text
/home/cube/.cache/task26-strict-successor-1786976146/src-p/checkin_cli/__init__.py
/home/cube/.cache/task26-strict-successor-1786976146/src-p/checkin_cli/customer_cleanup.py
/home/cube/.cache/task26-strict-successor-1786976146/src-p/checkin_cli/customer_cleanup_fs.py
/home/cube/.cache/task26-strict-successor-1786976146/src-p/checkin_cli/customer_cleanup_inventory.py
/home/cube/.cache/task26-strict-successor-1786976146/src-p/checkin_cli/customer_cleanup_models.py
```

Test file changed:

```text
/home/cube/.cache/task26-strict-successor-1786976146/src-p/tests/test_customer_cleanup.py
```

Exact pytest commands:

```bash
python -m pytest -q tests/test_customer_cleanup.py
```

Result: `11 passed`

```bash
python -m pytest -q tests/test_customer_cleanup.py tests/test_customer_admin.py
```

Result: `139 passed`

```bash
python -m pytest -q
```

Result: `731 passed`