I read this as a read-only final privacy and authority verification - I will validate sealed evidence, current artifacts, and live-state residue without changing anything.


I read this as final F2 privacy/authority verification - I completed read-only sealed-evidence and live-profile checks.

## FAIL - 99% confidence

The sealed candidate passes its privacy/authority controls, but the dedicated live profile contains forbidden trainer/customer workflow residue and an orphan authority record. Task27 evidence also has a hash-manifest inconsistency.

### F2 adjudication

| Requirement | Verdict | Evidence |
|---|---|---|
| Candidate integrity / exact candidate | PASS | Delivered inventory: 482/482 entries verified, 0 mismatches; candidate is `d1109d...39112`. |
| Customer DM isolation | PASS | Sealed `source-membership-evidence.json`: `identity_separated=true`; owner private DM only. |
| Customer-free owner/operator staff membership | PASS | Same sealed evidence: only owner staff chat; `membership_results=[]`. |
| Wrong-role fail-closed | PASS | Sealed full gateway receipt: staff membership gate 11/11, group gating 95/95; 8,552/8,552 total tests passed. |
| Authority lease coverage and revocation fencing | PASS | Sealed candidate gates all true; lifecycle evidence reports revocation-first mutations/sends = 0 and operation-first waits. |
| `store=false` advisory path | PASS | Sealed `gateway/platforms/telegram.py:9587` uses `store=False`; corresponding sealed gate is true. |
| Exact current candidate authority | PASS | Registry currently qualifies only `d1109d...39112`; registry head `b24fd4...78161d`, ledger head `55e9d7...a58fb4`. |
| Live customer disabled and nonconsenting | PASS | Direct registry check: sole customer is `enabled=false`, consent `false`. |
| Intended customer/bootstrap roots absent | PARTIAL | `data/customers` has 0 files and expected bootstrap directory has 0 files, but a live onboarding outbox remains. |
| Service stopped | PASS | `hermes-gateway-dualcoachtest.service`: `loaded/inactive/dead`, `MainPID=0`; no target process. |
| No trainer marker/claim/invite/card/route/data residue | **FAIL** | Live profile retains trainer bindings, claim data, role invites, cards, and customer route records. |
| No orphan authority | **FAIL** | Live `legacy-activation-authority.json` names `gate_d_delivery`, absent from the sole current registry customer. |
| No bootstrap/customer workflow | **FAIL** | Non-archived live outbox contains 26 committed customer records for one customer session/route. |

### Blocking findings

1. **Trainer residue remains in the live profile.** Examples:
   - `data/rehearsal-reset-archives/.../trainer-authority-removal-v1/`
   - `.../trainer-private-telegram-bindings.json`
   - archived `role-invites.json`, `draft-generation-cards.json`, and schedule claims.
   - Direct scan found 16 trainer-named paths and numerous trainer-content files.

2. **Customer workflow remains live despite cleanup.**
   - `data/onboarding/telegram-publication-outbox-v1/ledger.json`
   - 26 committed records, all `role=customer`, for the cleaned session. This is retained customer route/workflow data outside the Task27-targeted bootstrap directory.

3. **Orphan authority remains live.**
   - `data/migrations/nutrition-readiness-v1/legacy-activation-authority.json`
   - References `gate_d_delivery`; that key is not present in `customers/registry.json`.

4. **Task27 evidence is internally inconsistent.**
   - `receipt-hashes.sha256` expects controller SHA-256 `d57c8564...`
   - Actual `task27_final_cleanup_controller.py` is `8aee38ea...`, which matches the cleanup receipt.
   - The separate nonmutation attestation still binds `d57c8564...`.
   - Therefore the hash manifest/nonmutation attestation is stale and cannot support a PASS.

### Evidence and hashes

- Delivered bundle: `.omo/evidence/task26/task26-combined-v38-delivered-st_01a019d7`
  - candidate: `d1109d8f78aaccf949ec4f664d9e62584c3cca33032030518bc3e2d712239112`
  - delivered inventory seal: `8009d317175b3e4bbea1d89e6390ee17e1608838333cda234d6e75fbef033fb7`
  - candidate file: `c2ee2f49e43544bf2fe407aa6970245afb292f9dbc6580e39abc6e27b57bf3d4`
  - authority registry: `4dbdc87fadc2d7bce881f87418df95891e208a063d86e14df407ccbd6d56311c`
  - authority ledger: `caed9325ae7adcef96beec2528bec743637d0a1b5213fe7ff390c3c6119b5d3a`
- Postfreeze PASS: `.omo/evidence/task26/task26-combined-v38-postfreeze-receipts-st_01a019d7/PASS.json`
- Cleanup receipt: `.omo/evidence/task27/task27-live-cleanup-receipt.json`
  - SHA-256: `7848def41100aa4f4ef27239dfaae3cc634d5ad2b24df7966d4d80838f692a3a`

### Read-only commands/results

- `python3 -B` delivered-manifest verifier: **482 checked, 0 bad**.
- `sha256sum -c .omo/evidence/task27/receipt-hashes.sha256`: **failed** for `task27_final_cleanup_controller.py`.
- Direct live registry/outbox/orphan check: **disabled/nonconsenting true; legacy authority orphan true; 26 customer outbox records**.
- `systemctl --user show hermes-gateway-dualcoachtest.service ...`: **inactive/dead, MainPID=0**.
- Sealed full qualification receipt: **8,552 passed, 0 failed**.

Activation, delivery, or release remains blocked until the live residue, orphan authority, and stale Task27 evidence manifest are removed/resealed.