I read this as a read-only forensic audit - I’ll trace the rehearsal artifacts against the source contracts, validate success and all 12 rollback/replay cases byte-for-byte, then return PASS/FAIL with exact evidence.


The artifact set contains one success image plus exactly 12 stage-specific rollback images. I’m now reducing each image to its transaction metadata, receipt state, snapshot manifest, and replay result, then independently checking those claims against the implementation’s v4 validator and rollback path.


The independent checks now show the success receipt passes the production validator, and every rollback artifact has matching restored snapshot bytes/modes, matching protected preflight hashes, no receipt or receipt directory, and `CONSUMED/FAILED` plus final `ROLLED_BACK`. I’m doing the final binding digest reconciliation and provenance hash pass before issuing the verdict.


I read this as a read-only forensic audit - I traced the artifacts against the production validator and rollback implementation without edits or live actions.

# PASS

Evidence root report SHA-256:

`5036e21e294184bf26c4376b7814bdc66777cc8214d9734d98006ef379129074`

## Success case

Receipt:

`success/profile/data/customer-activation-receipts/pilot_20260820_01.json`

- File SHA-256: `fde6b2bfac72e4b56b89346e20ac06f94ddaa35af9623dc58334628ec37fb71f`
- Production `validate_committed_activation(..., customer_id="pilot_20260820_01")`: **True**
- Version/source/state: `4 / 3 / committed`
- Customer: `pilot_20260820_01`, currently enabled
- Enabled customers/capacity: `1 / 5`
- Candidate: `bf7dfa0a5ef4104033cb1a191d4ffe437c1d03fc7d6323d4dd1d7c7cc383cfcb`

Exact binding matches:

| Binding | Recomputed digest |
|---|---|
| Customer projection | `579e05bc45972cfa5a1788b87c30ee0587c5e018f622aa6938fa1b2900367350` |
| Current owner authority | `3d86eb7fc1df627e25863ac5d5c0318d91d6fde0405a281708850a9fdbc20b6f` |
| Capacity-5 admission policy | `694ff93745fb25a8c445ff3eb35d65fc2e2347924a110b4b538db81e3a2796cf` |
| Audit record | `75aae88bec180d1249152e32e7599b3bf344de58def8d8884e939eb3f0631ef1` |
| Membership evidence | `3015e5ff2c63b884d681f0b151978d25465e8485e690e5c40cf16020221e035f` |
| Nutrition readiness receipt | `8c3ae56506bd765de7e4d8d89242ccfd914d5bfee220f0878c601fb1a486e171` |

The audit transaction/customer, nutrition receipt, membership digest, inventory digest, subscription epoch, nutrition customer, and input-reconciliation bindings all match exactly.

The production checks enforcing these bindings are in `dualcoach/profile/checkin_cli/customer_admin.py:2032-2297`.

## Twelve injected failures

Every case independently passed:

- `stop`
- `post_stop_snapshot`
- `stopped_probe`
- `install_exact_wheels`
- `off_smoke_channel_inbox_off`
- `capacity_dry_run`
- `weekly_and_capacity_apply`
- `weekly_startup_smoke`
- `switch_unit_dropin`
- `reload`
- `start`
- `post_fence`

For **all 12**:

- Activation receipt absent.
- Newly created `customer-activation-receipts` directory absent.
- All three manifest-declared created files and the created directory absent.
- Successor runtime absent.
- Newly created weekly-authority tree absent.
- Four protected preflight hashes match current bytes.
- Ledger is exactly `status=CONSUMED`, `outcome=FAILED`.
- Final phase is exactly `ROLLED_BACK`.
- Replay was denied with `authorization_already_used`; the report row is emitted only after that denial.
- Phase remains `ROLLED_BACK` after replay denial.

For the 11 failures after snapshot capture, all four snapshot files match both manifest SHA-256 and restored live-file SHA-256/mode. The `stop` fault occurs before capture, so it correctly has zero snapshots; its protected preflight bytes still match.

Rollback mechanics are enforced at:

- Snapshot restore/removal: `scripts/nutricoach_v150_sealed_controller.py:101-103`
- Single-use replay denial: `:171-173`
- Failed consumption/rollback: `:215-216`
- Matrix postconditions and replay assertion: `scripts/rehearse_nutricoach_v150_v14.py:245-279`

## Live-byte isolation

`report.json` records:

- `case_count: 13`
- Every case: `PASS`
- `live_source_unchanged: true`
- `network_namespace: loopback-only`

The rehearsal hashes live registry, config, complete data tree, unit, and drop-in before and after, failing on any difference at `scripts/rehearse_nutricoach_v150_v14.py:274-290`.

No edits, live service operations, network, Telegram, provider/customer actions, commit, or push were performed.