I read this as hands-on offline QA of the delivered v38 candidate - I’ll inspect the delivered root and test harness, execute the specified isolated scenarios without external mutations, then report PASS/FAIL/INCONCLUSIVE.


I read this as final consolidation of completed offline QA only - I’ll verify that my disposable QA roots and processes are gone, then issue the requested PASS/FAIL/INCONCLUSIVE matrix without further scenarios.


I read this as final offline QA reporting - the delivered v38 candidate is PASS.

| Scenario | Result | Evidence |
|---|---|---|
| Independent verifier / frozen bootstrap | PASS | Both run directly on delivered root; sealed-wheelhouse-only rehydration passed. |
| Seal attacks | PASS | Extra file, symlink, and writable sealed input each rejected preflight. |
| Profile execution / forgery | PASS | Exact digest-matched profile source executed: 749/749 passed. Forgery coverage passed in 126 targeted tests. |
| Direct URL / Ty forgery | PASS | Direct-URL forgery coverage passed; Ty semantic 3.14 forgery rejected. |
| Transport Ty span | PASS | Python 3.12 hermetic Ty: 809 diagnostics, 0 capability-span diagnostics, 9 spans. |
| Ingress/background revocation | PASS | 50 authority/Telegram/profile tests passed; installed-wheel local loopback polling revoked before inbound handling: 0 post-revoke mutations. |
| Task26-disabled path | PASS | Installed runtime background authorization yielded `None` and preserved behavior. |
| Local socket | PASS | Real loopback socket observed `getMe`/`getUpdates`; no external traffic; server/socket/watcher cleanup passed. |
| Controller CLI / `store=false` | PASS | 19 controller tests passed, including nonpersistent `store=false` enforcement. Installed CLI help passed; missing arm receipt returned NO_GO without service start. |
| Cleanup | PASS | Disposable `task26-v38-*` roots: 0 remaining. No residual QA watcher/process remained after the cleanup command exited. |

Verification totals: `126 passed`, `50 passed`, `19 passed`.

No real Telegram, provider request, profile mutation, service start, or release was executed. No required offline scenario was left unexecuted.