I read this as an implementation-and-verification task - I’ll inspect the delivered v38 tooling and live state read-only, then build and fault-test a sealed one-use controller entirely in `.omo/evidence/task27/` using disposable copies.


The live blocker and target identity are confirmed. I’m now binding the controller to the delivered v38 artifacts and the canonical cleanup API, then I’ll exercise transactional rollback and all requested refusal cases against copied profiles only.


Implementation is starting with a fail-closed design: dry-run seals the live baseline and immutable v38 tools; execute accepts only a non-live copy whose mutation-relevant state matches that baseline, rechecks the real stopped service, locks the profile, rolls back any incomplete transaction, and emits immutable forward-only evidence only after terminal verification.


The dry-run produced a live-bound permission seal and diagnostics are clean. Verification now moves to disposable reflink copies: one successful real-wheel rehearsal, then independent copies for drift, permission, extra-session, active-service, symlink, and injected-fault rollback cases.


The successful rehearsal now commits through the delivered profile wheel, and all seven adversarial/rollback cases pass, including faults after canonical archive verification and after bootstrap pruning. I’m performing the final read-only live/other-profile equality snapshot, sealing receipt hashes, and removing disposable runtime copies.


I read this as completed implementation and verification - reporting the sealed disposable rehearsal and live non-mutation proof.

Built `.omo/evidence/task27/task27_final_cleanup_controller.py`.

- Permission seal: `4d9bb075810690bf96f21e6e2e942916ac5ff50df561433280a8363e45b97a63`
- Service: `inactive/dead`, `MainPID=0`, zero matching processes
- Rehearsal: `COMMITTED` on deleted disposable copy `/tmp/task27-success-2381036/profile`
- Operation: `64fb954b89d047cb9592c26eefbc2f7b`
- Terminal state: disabled, nonconsenting, delivery off; customer/bootstrap absent; active/pending/unknown/orphan all zero
- Eight adversarial cases passed, including permission mismatch, drift, extra session, active service, symlink, two rollback points, and one-use refusal
- LSP diagnostics and compilation passed

Proposed live mutation set:

```text
customers/registry.json
data/customers/task26_claim_20260818145508_1b96b23d/**
data/customer-cleanup/task26_claim_20260818145508_1b96b23d.journal.jsonl
data/customer-cleanup/archives/<operation-id>/**
data/onboarding/telegram-customer-bootstrap-v1/**
data/task27-final-cleanup/archives/<operation-id>/**
data/.profile-authority.lock
```

Commands exercised:

```bash
python .omo/evidence/task27/task27_final_cleanup_controller.py dry-run \
  --output .omo/evidence/task27/task27-live-dry-run.json

python .omo/evidence/task27/task27_final_cleanup_controller.py execute \
  --profile /tmp/task27-success-2381036/profile \
  --permission-file .omo/evidence/task27/task27-live-dry-run.json \
  --permission-seal 4d9bb075810690bf96f21e6e2e942916ac5ff50df561433280a8363e45b97a63 \
  --output .omo/evidence/task27/task27-rehearsal-receipt.json
```

Receipt hashes:

```text
71bde09e4112b0c1d24a5f7d4666ab5e61951afc3d99fa98972958ddeee856b6  task27-live-dry-run.json
4f84d7474bb0dd6ace5bdfd1f880deaf9ec0baeeb52e0dad149373d0b0c641dd  task27-rehearsal-receipt.json
08264241a690d0189726132437712232ebe551b6f51392718bf82a290b8f7569  task27-verification-receipt.json
ea1abafc9a74024591e60c2ee527fdfc95e85fb299e48f8bf68c36fb7100ef82  task27-live-nonmutation-attestation.json
```

Live before/after equality: all `true` for the complete 67,012-entry profile, registry, bootstrap, customer subtree, cleanup roots, service state, and both other profiles. Live digest remained:

```text
24216f7c2381e0b42118c1b9f03b45d64b96bcf29d87fa83811bc0a15e592bd9
```

No live profile, Telegram, provider, service, commit, or push action occurred.