I read this as an independent read-only release verification - I will inspect the sealed package and live state, run isolated clone validation only, then record sibling evidence and authorize only if every required check passes.


I read this as a mandatory verification-policy update - I will load and apply the specified upgrade skill before continuing the independent read-only checks.


I read this as continued verification under the loaded upgrade policy - I will independently derive package authority and inspect the controller, live bindings, and isolated rehearsal contract without touching production.


I read this as a source-and-live contract audit - I will now run only isolated static/read-only validators and inspect direct live facts; the package’s configured type checker exclusions and pre-stop snapshot ordering are already material authorization concerns.


I read this as a failed safety gate rather than an upgrade authorization - I will document the independent blockers outside the package after one correctly rooted strict type check and a final byte-identity check; no live or package mutation will occur.


I read this as finalizing a failed independent audit - I will preserve a minimal immutable sibling record of the verified findings and return a non-authorization verdict without executing the unsafe transaction.


I read this as a failed release-safety verification - I blocked authorization and recorded immutable sibling evidence.

**DO_NOT_AUTHORIZE** - the controller snapshots before Gateway stop, does not durably preserve stop-time volatile bytes, and accepts noncanonical/unknown/conflicting append suffixes.

Additional blockers: all-mode basedpyright reports 113 errors; no-excuse reports 24 violations; configured pyright excludes controller/test files; LSP has one hint.

Evidence: `.../upgrade-independent-verification-v2-20260826T122710KST-st_01a03c30/VERDICT.md`