I read this as a read-only release audit - I’ll trace the V14 r12 architecture and evidence end to end, independently verify every named blocker under bytecode-disabled execution, and return an exact PASS/FAIL without modifying or invoking live surfaces.


I read this as a read-only release audit - I traced the sealed execution chain, independently verified integrity, and compared the rehearsal report with its raw terminal state.

# Final verdict: FAIL

- **Candidate `5334774e...220b5c`: FAIL release-quality** — identity and immutability checks pass, but its controller contains the terminal-state defect below.
- **V14 r12 preseal: FAIL release-quality** — cryptographic/inventory verification passes, but it embeds the defective controller.
- **V14 r12 rehearsal: FAIL** — its `PASS` report contradicts raw terminal evidence.
- **Overall release decision: FAIL / DO NOT SEAL OR EXECUTE.**

## Blocking evidence

All 12 rollback cases end in nonterminal `PREPARING`, not `ROLLED_BACK`:

```text
terminal_phases:
1 COMMITTED
12 PREPARING
```

Affected paths are every:

```text
task-v14r12-rehearsal/rollback-*/execution/phase.json
```

Each has a consumed `FAILED` ledger, and no reservation remains:

```text
12 FAILED
1 SUCCEEDED
reserved_ledger_count=0
```

The cause is deterministic:

1. Rollback correctly writes `ROLLED_BACK` at
   `nutricoach_v150_sealed_controller.py:94-130`.
2. The rehearsal then retries each consumed authorization at
   `rehearse_nutricoach_v150_v14.py:237-248`.
3. `_execute()` writes the recovery manifest and advances to `PREPARING` **before** checking the one-use ledger:
   - recovery manifest: controller line 169
   - `PREPARING`: line 171
   - reservation/replay rejection: lines 172-176
4. Replay is denied, but the terminal journal has already been overwritten.
5. The rehearsal never asserts terminal phase before declaring `PASS` at lines 249 and 259-274.

Raw report SHA-256:

```text
b9880f792561a4216d2542327a4d0f12c777fdb2ef73ac370db62382a46d3a39
```

Its claimed `PASS:13` is therefore a false positive.

## Prior-blocker matrix

| Check | Result | Evidence |
|---|---|---|
| Exact controller inventory | PASS | 318 declared/actual; 0 missing, undeclared, or hash mismatches |
| Complete preseal package inventory | PASS | 326 declared/actual excluding manifest; 0 mismatches |
| Undeclared bytecode | PASS | 0 `.pyc`/`.pyo`; post-verification count remained 0 |
| `-B` / `PYTHONDONTWRITEBYTECODE` | PASS | Bootstrap lines 162 and 167-176 set both before importing worker/controller |
| Protected-inventory digest | PASS | Bound and actual: `d2c084be0865f8e9844452a7b683f97800e31af9bc7e1a113241109a283aada5`; checked before `protected_paths()` use at concrete-host lines 201-219 |
| PREPARING/RESERVED/STOPPING recovery without snapshot | PASS in code | Controller lines 209-224 exclude all three phases from snapshot loading; rollback lines 94-130 restore service and write `ROLLED_BACK` |
| Candidate/preseal bytes | PASS | All 324 candidate and 327 preseal regular files mode `0444`; no symlinks or writable files |
| Candidate immutability during audit | PASS | Tree digest unchanged: `8bb6752bf8cf70dee448cfc75630dcf250f97737c422ee57029bd0a8ed8b63c4` |
| Preseal immutability during audit | PASS | Tree digest unchanged: `6b216b85301e7714fcf93e92c39ce99fc2ed6a2ddb17cf7a493ec7a16e53c449` |
| Launcher/bootstrap/controller binding | PASS | All bind `live-transaction-preseal-v14-live-representative-r12`; sealed target binds candidate and authority roots |
| Registry binding | PASS | Live and bound registry SHA-256: `bd61ed95f80737ba8013db262fd0242a600e540f43f6627f5b9708a599660b29`; shape digest `bb911adcae1efd5888b853a62925ac2461b7d1978666e0cdfb67f4de52a15be5` |
| One-use ledger | PASS for denial | `O_EXCL` reservation and consumed check at sealed-authority lines 190-246; all rehearsal attempts consumed |
| Rehearsal terminal phases | **FAIL** | 12 rollback cases finish `PREPARING` |

## Independent read-only verifier

Executed with `/home/cube/miniconda3/bin/python3.12 -B` and `PYTHONDONTWRITEBYTECODE=1`; exit `0`:

```text
candidate_digest=5334774ea888af08e98ba1706b4b3fb954741e4042ee57741bc434ffbf220b5c
package_digest=88865623d3acae067b1e32b38ddd83a06fc1ccec7bcaca3e2def0cd4a1bb82fc
package_sha256=cc2974ec006ae4cfc26ebcea519a1fab6513850136dca9773ff844a0fa4e66de
closure_digest=sha256:4a5ff142410b50aa3c057d758fe6c550c0bda4f1573921959c8f13dd05af6a83
status=V14_LIVE_REPRESENTATIVE_PRESEAL_VERIFIED
```

This verifier does not inspect rehearsal terminal phases, so its success does not clear the blocker.

## Correction designs

1. **Recommended: atomic reservation before execution-state writes.** Reserve globally first, immediately enter the consume-on-failure boundary, then write the recovery manifest and `PREPARING`. Add ledger-only recovery for crashes before a phase exists. Lowest migration cost and prevents rejected replay from touching a terminal journal.
2. **Append-only per-attempt journals.** Bind an immutable attempt ID into the global reservation and never reuse an execution root. Stronger forensic isolation, but significantly more state-machine and migration complexity.

The first design is sufficient. It must be accompanied by assertions that every rollback remains `ROLLED_BACK` both before and after a rejected replay.

No files were modified, and no authorization, live execution, service, network, Telegram, provider, customer, commit, or push action was invoked.