I read this as a read-only lifecycle audit of the frozen V14 r2 package - I’ll trace preflight through rollback/postcommit against the rehearsal evidence and stop at the first evidence-backed PASS/FAIL conclusion.


I read this as a final read-only lifecycle verdict - the frozen V14 r2 package is not safely executable and must fail audit.

# FAIL

## Blocking findings

1. **The frozen controller closure has drifted.**
   - `live-transaction-preseal-v14-live-representative-r2/controller-source-manifest.json:1` expects:
     - worker `1f40156c...`
     - bootstrap `1d4b5678...`
     - controller `c511f998...`
   - Observed hashes differed for all three.
   - The current bootstrap explicitly targets r3 at `scripts/nutricoach_v150_detached_bootstrap.py:15-18`; the r2 sealed target still binds r2 at `sealed-target.json:1#/controller_target_binding`.
   - Closure verification at `nutricoach_v150_detached_bootstrap.py:148` must therefore deny with `closure_drift` before authorization or mutation.

2. **Crash recovery does not cover the stop-to-snapshot gap.**
   - The journal records `RESERVED`, then stops the service, then creates the snapshot at `nutricoach_v150_sealed_controller.py:170-176`.
   - Recovery unconditionally loads that snapshot at lines `199-204`.
   - A kill after line 173 but before snapshot completion leaves the predecessor stopped and recovery unable to load rollback authority.
   - `report.json:1#/cases` covers injected stage exceptions, not process death in this window.

3. **Service restoration can falsely record `ROLLED_BACK`.**
   - Rollback tries `start()` twice at `nutricoach_v150_sealed_controller.py:112-117`, but never asserts that the service is running after the second attempt.
   - Lines `123-125` can consequently persist `ROLLED_BACK` while the service remains down.
   - Rehearsal evidence contains restored unit/drop-in bytes, but no independently recorded post-rollback service state.

4. **Postcommit reconciliation has a durable gap.**
   - `COMMITTED` is persisted at `nutricoach_v150_sealed_controller.py:194-195`.
   - The global ledger is only changed to `SUCCEEDED` afterward by `nutricoach_v150_sealed_authority.py:262-270`.
   - A kill between these operations leaves phase `COMMITTED` with a permanently reserved ledger. Recovery treats `COMMITTED` as terminal and does not reconcile it.

## Evidence that did pass

- All eight preseal package-manifest entries matched.
- The rehearsal reports 13 PASS cases.
- Each available rollback snapshot restored its four mutable files byte-for-byte and mode-for-mode.
- Success created the successor runtime, weekly authority, canonical `events.jsonl`, and `.events.lock`; rollback cases removed them.
- Preflight evidence shows `canonical-sequence.jsonl` already existed, while the canonical events and lock files did not.
- The startup-smoke code selects the successor interpreter at `nutricoach_v150_concrete_host.py:313-328`, and the success artifact contains installed wheel RECORDs.

## Architecture options

1. **Recommended: create a new immutable package with an explicit recovery state table.**
   Package the controller source itself, add recoverable `STOPPED_NO_SNAPSHOT` and `COMMITTED_PENDING_LEDGER` states, and require final predecessor service observation before `ROLLED_BACK`. Lowest coupling and clearest failure semantics.

2. **External recovery supervisor.**
   Keep the controller simpler but add a separate watchdog that owns stop-state recovery and commit/ledger reconciliation. This adds another authority boundary, more operational coupling, and harder testing.

**Recommendation:** reject r2 and issue a newly digested package using option 1. Do not authorize this package. No files were modified and no live, network, provider, or Telegram operation was invoked.