I read this as a test-first production fix for shared cleanup ledgers - I’ll inspect the cleanup flow and real Golden Path schemas, add RED coverage, implement the narrow typed projection API, and run the requested verification without touching excluded areas.


Exploration found one required shared authority in the actual candidate surface: `data/owner-actions/draft-generations.json`, whose native schema is a token-to-history mapping with exact per-record `customer_key` and lifecycle `state`. I’m starting with focused RED tests around a typed `SharedLedgerProjection.DRAFT_GENERATIONS` API; whole-file candidates remain unchanged and strict.


message: Codex error: An error occurred while processing your request. You can retry your request, or contact us through our help center at help.openai.com if the error persists. Please include the request ID fc6edeb2-dc44-47e9-b9c4-eab9ab8aae8b in your message.

stop_reason: error


The RED suite failed first on the missing typed API, then the focused implementation reached GREEN for shared-ledger, cleanup, and admin coverage (146 tests). The projection source is now opened component-by-component with `O_NOFOLLOW`, remains in place, and resume verification rebinds both source identity/content and canonical target-only projection; I’m moving to full static and profile verification.


I read this as delivering the source-ready shared-ledger cleanup fix - implementation and verification are complete without running the Golden Path.

Implemented in:

- `checkin_cli/customer_cleanup_shared.py`
- `checkin_cli/customer_cleanup.py`
- `checkin_cli/customer_cleanup_inventory.py`
- `checkin_cli/__init__.py`
- `tests/test_customer_cleanup_shared_ledgers.py`

API:

```python
archive_customer_cleanup(
    root,
    customer_key,
    shared_ledger_projections=(
        SharedLedgerProjection.DRAFT_GENERATIONS,
    ),
)
```

Contract:

- Whole-file `candidate_paths` remain strict.
- Only `data/owner-actions/draft-generations.json` is explicitly supported.
- Shared source is securely opened and preserved.
- Archive schema: `customer-cleanup-archive-v2`.
- Projection schema: `customer-cleanup-draft-generations-projection-v1`.
- Manifest binds source digest/device/inode/mode/size, selector version, record count and ordered digests, projection digest/path.
- Resume verifies unchanged source and projection.
- Inventory distinguishes terminal retained history from active/pending/unknown authority.
- Foreign customer records and pending state do not affect target cleanup.

Test-first result:

- RED: collection failed because `SharedLedgerProjection` did not exist.
- GREEN:
  - Shared-ledger tests: **8 passed**
  - Shared + cleanup + admin: **147 passed**
  - Full profile: **739 passed**
  - Ruff: **all checks passed**
  - Ty on changed cleanup/test surface: **all checks passed**
  - Compileall: passed
  - Manual two-customer temporary driver: committed, target-only projection, foreign pending ignored, source preserved.

Full-project Ty still reports pre-existing diagnostics outside this change; changed files are clean. No Golden Path, Git, harness, services, plan, todo, or evidence modifications were made.