I read this as a read-only release-forensics audit - I’ll trace every supplied artifact and live-state invariant end-to-end, then return a strict PASS/FAIL with the complete refreshed-manifest receipt set.


The committed chain is present and internally names the exact candidate, controller, preview, authorization, and prior cleanup receipt. I’m now independently recomputing live archive/state invariants and the one-use refusal path rather than relying on the terminal receipt’s assertions.


Live cleanup now independently verifies: both operational sources are absent, the archive re-normalizes to the exact pre-cleanup digests, every archive node is frozen (`0500/0400`), active target matches are zero, and other-profile digest remains unchanged. The sealed candidate also passed its isolated verifier under the bound Python 3.12 interpreter; the earlier Python 3.13 attempt failed only for incompatible cp312 wheels and is not a candidate defect.


I read this as a read-only release-forensics audit - I traced the supplied chain, independently verified live state and candidate integrity, and checked completion gates.

# F5 verdict: PASS

F5 may be checked.

## Exact provenance chain

- Candidate: `d1109d8f78aaccf949ec4f664d9e62584c3cca33032030518bc3e2d712239112`
- Initial cleanup receipt: `7848def41100aa4f4ef27239dfaae3cc634d5ad2b24df7966d4d80838f692a3a`
- Supplemental controller: `65fc6c93e4ba7b0efaff84563f50d37875d150551a00260e7f3ade7b9d009e9f`
- Supplemental tests: `3833be95b478bcce4e96c6f7b95c07930d86e8b3f804fd7a5fffc324416fa3c1`
- Approved preview v2: `670c9d07198942503a9da892d4dc723312ec60ccab538c8552f78a1b22660287`
- Final authorization: `83a46c25d8a0ef67c71511e0b1786154f075a2b4572f9b4f9feaec34a6d3e6f1`
- Authorized dry-run: `2058cc2870215d5385396c04ca5caed0436d68d854c7e7e7565b6a23d694e356`
- Final receipt: `13b28b5745cf1fb6e8aa9457f14ad86dbf972c3c203394e2fd919d99b7bf659d`
- Operation: `005a3c3f9897e2d298a9a7409759509e`
- Preview permission seal: `7d7b9d5b1da8c655bfae188841ffdf0da62818be952e43cfe1f8b5781cd61889`
- Authorized execution seal: `6cd72f0cc4e7504e71d0203f00f0df085bdae2bc3861d66ef705053a75126774`
- Archive manifest: `636acca796ef627cc488c85d5cbc79894eaaa1ee68bbd8660aaf7692d4b9b7e2`
- Consumption record: `8e6b7d0bb30fc891d20b6fdf9a02edaf879546dce8c8328598ab98e9fb689d75`

## Independent evidence

- Source/copied identity:
  - Outbox: 8 entries, `29f118abddb5b569939822b5e29c38830587d762371108dfe2bc661a267bd104`
  - Membership: 3 entries, `ff57a22a122a083a87020a8802cace1c7ee68eaeaafd90d84a242ab76dfee367`
- Archived and evidence receipts are byte-identical, both hashing to `13b28b57...f659d`.
- Archive is fully frozen: directories `0500`, files `0400`; zero violations.
- Authorization status: `CONSUMED_ON_COMMIT`; receipt, manifest, and consumption projections agree exactly.
- Live outbox and membership sources are absent.
- Active target matches: `[]`.
- Original customer directory and bootstrap authority remain absent.
- Registry has exactly one target row: `enabled=false`, consent `granted=false`.
- Service: `inactive/dead`, `MainPID=0`, zero matching processes.
- Reexecution returned exit `2`: `output already exists; receipt reuse refused`.
- No rollback temporary remains.
- Other profiles unchanged:
  - Aggregate: `9096c74dac8583eb8186f37fcb15ac06ff13795269979af808dd0855d85b51b6`
  - Quarantine: `eddf21f8b17b85a0002b1cb9bbdc7881dc1190efae0ed17a2e53d6b9a7bf7bcb`
  - `physique-coach`: `0b593d81c6a7b0e9ab18e3c0842e06188776c1f2a1bc6e4e08a920771800a899`
- Supplemental tests: **22 passed**.
- Independent sealed-candidate verifier: `TASK26_INDEPENDENT_CANDIDATE_PASS`
  - Receipt: `f3b347f9f8b3f2d82188afb4c146ab3deb2845a3da3ce38c52d68c7ba5ccf9e6`
  - Delivered seal: `54be54cf89720057486596a21941ec5d456a1c54148f66dbde0475503a752f67`
  - Postfreeze seal: `3002d815d7523c2971c990544d92c1f0d16fd51781f83d9d636ef6336b5878f6`
- Historical suspension remains immutable at `9be5a187ace59a72099ace5262923cfee0ca96d7c5971608e87eb2ef53d23a87`, mode `0400`.

## Refreshed manifest entries

The current `receipt-hashes.sha256` is stale (`6bfe4647...c0f9c7`). Its replacement must cover these 28 top-level artifacts, excluding the manifest itself:

```text
ff1ca1174bffe83160b3443b3ec01a52f354801970976eddf85460c715e490c6  task27-live-authorized-dry-run.json
c3b43617fd7cbe2955b943eb85708ef7a908ac4c2a83ffa13995d47c79f2ad5e  task27-live-cleanup-authorization.json
7848def41100aa4f4ef27239dfaae3cc634d5ad2b24df7966d4d80838f692a3a  task27-live-cleanup-receipt.json
71bde09e4112b0c1d24a5f7d4666ab5e61951afc3d99fa98972958ddeee856b6  task27-live-dry-run.json
ea1abafc9a74024591e60c2ee527fdfc95e85fb299e48f8bf68c36fb7100ef82  task27-live-nonmutation-attestation.json
4f84d7474bb0dd6ace5bdfd1f880deaf9ec0baeeb52e0dad149373d0b0c641dd  task27-rehearsal-receipt.json
c55ef3919d5ce97b2f39b0bba83cc2f11b2828abaa9494fa2c19e69ef874e045  task27-supplemental-live-authorized-dry-run.json
2058cc2870215d5385396c04ca5caed0436d68d854c7e7e7565b6a23d694e356  task27-supplemental-live-authorized-final.json
83a46c25d8a0ef67c71511e0b1786154f075a2b4572f9b4f9feaec34a6d3e6f1  task27-supplemental-live-cleanup-authorization-final.json
5807eb0b192a979e922344a37b50f29d58bf41739c66eb2bed76aed31eb54bef  task27-supplemental-live-cleanup-authorization.json
13b28b5745cf1fb6e8aa9457f14ad86dbf972c3c203394e2fd919d99b7bf659d  task27-supplemental-live-cleanup-receipt.json
27fdf36ce3a2ee6333de01370437fa63707dd7a34afd4824b86019bb29d1a79a  task27-supplemental-live-dry-run.json
670c9d07198942503a9da892d4dc723312ec60ccab538c8552f78a1b22660287  task27-supplemental-live-final-preview-v2.json
ddf21a315eac2bddf544cd0bb7e970133abb161d0415cc784576a8fb1d8760b2  task27-supplemental-live-final-preview.json
e0b8b462591756b03bb0a7ab89024377eb124b4f8e34a22c2949d2c92753fd86  task27-supplemental-live-nonmutation-receipt.json
0c5adbd19fdedaf97f920c4469f7096aab5dd440c973d52d080c1c844a39cb6c  task27-supplemental-rehearsal-receipt.json
72278c3599c2362f0141f2fbd485f87525399d723119831ac1e7dd5052c49137  task27-supplemental-verification-receipt.json
45c28455dcbcfbd5a0ac74807850e4d76a59d4b14592e622031a07862c5d2848  task27-v38-bounded-pilot-release-verdict.md
f0733e9f22bffdf57809c30e5830f7d6240dba9c1f67752882df4341556d07f9  task27-v38-final-verification-f1.json
138806a22606f55c5bea67c46c139ad89605165596886a69e1c27d207672f70c  task27-v38-final-verification-f2-initial-fail.json
55bdbc3f0f2ada90c94dc87dde365b4f19b3c868a839d700575835b498ab7740  task27-v38-final-verification-f3.json
3f9fd3f1182dcbc51785cb41af865e2b4cf8bfddd2d1ad1449c7a43fd5256f7a  task27-v38-final-verification-f4.json
b979b10614e94966eab6965b5d9f064c0ce95f2d74b0d0b19cf8379de658c824  task27-v38-final-verification-f5.json
9be5a187ace59a72099ace5262923cfee0ca96d7c5971608e87eb2ef53d23a87  task27-v38-verdict-suspension.json
08264241a690d0189726132437712232ebe551b6f51392718bf82a290b8f7569  task27-verification-receipt.json
8aee38ea920cbaa2b18d7ebe0104aa1baeabcaeb49152f25819ee1380ebbc443  task27_final_cleanup_controller.py
65fc6c93e4ba7b0efaff84563f50d37875d150551a00260e7f3ade7b9d009e9f  task27_supplemental_cleanup_controller.py
3833be95b478bcce4e96c6f7b95c07930d86e8b3f804fd7a5fffc324416fa3c1  test_task27_supplemental_cleanup_controller.py
```

## Blockers / checking status

- **F5:** may be checked **PASS**.
- **Task27:** must **not yet** be checked complete.
- Remaining blockers:
  1. Replace the stale receipt manifest with a refreshed complete manifest.
  2. Record a fresh post-cleanup F2 result; only `task27-v38-final-verification-f2-initial-fail.json` currently exists.
  3. Preserve the historical suspension and issue any final Task27 release verdict only after the refreshed lanes/manifest are sealed.

No files were edited.


I read this as a final read-only closure spot-check - I’ll verify the four hashes, manifest completeness, and the final report’s Specification 27 pilot/rollback coverage, then return only confirmation or an exact blocker.


I read this as a final closure confirmation - all requested checks passed.

**CONFIRMED**

- Report SHA: `31d7daa60dad93dce41761b2c36f1fe3ec38e8f9257761fd9b6771d83ac32a76`
- Consolidated F1-F5 SHA: `4f578c4752a9728d40308a0faa52b4ad22349af8483e9d522c0fb343ba70a2a4`
- F2 PASS SHA: `9290bd5cb7b7f92c18a9e1dd236f2822904be53162079b66738c9701bf5c4d71`
- Manifest SHA: `50eb92a4ef7fde599aad82f445f5ba12a456895a9050319642163303ef7aed9d`
- Manifest: 36 unique entries; exactly all 36 current top-level artifacts except itself; no missing, extra, or duplicate entries; `sha256sum -c` all OK.
- Final report covers Specification 27 scope, provenance, privacy/authority, qualification, real surfaces, exactly-once/recovery, cleanup, F1-F5, bounded pilot sequence, observation scope, immediate-disable criteria, rollback, and residual risks.