I read this as read-only release QA for r20 - I’ll locate the prescribed verifier, tests, runtime artifacts, and credential/launcher evidence, then run only the requested non-mutating checks.


I read this as read-only r20 QA - I completed the requested checks without service-control, provider, Telegram, network, or release-authority actions.

**PASS**

- Exact r20 preseal verifier:
  ```bash
  cd .../live-transaction-preseal-v14-live-representative-r20/controller-source
  PYTHONDONTWRITEBYTECODE=1 .../nutricoach-v150-combined/.venv/bin/python \
    scripts/verify_nutricoach_v150_preseal_v14.py --verify
  ```
  Output: `V14_LIVE_REPRESENTATIVE_PRESEAL_VERIFIED`; candidate `3dab1a55...`, package `c88bf7cd...`.

- Existing-interpreter regression tests (no `.venv` created):
  ```bash
  PYTHONDONTWRITEBYTECODE=1 PYTHONPATH='dualcoach/profile:.' .venv/bin/python \
    -m pytest -q -p no:cacheprovider \
    tests/test_nutricoach_v150_preseal_v14.py \
    tests/test_nutricoach_v150_v14_safety.py \
    tests/test_nutricoach_v150_live_binding.py \
    tests/test_nutricoach_v150_sealed_controller.py \
    tests/test_nutricoach_v150_weekly_authority.py
  ```
  Output: `62 passed in 9.25s`.

  ```bash
  cd dualcoach/profile
  PYTHONDONTWRITEBYTECODE=1 PYTHONPATH='.' ../../.venv/bin/python \
    -m pytest -q -p no:cacheprovider tests/test_multi_customer_migration.py
  ```
  Output: `5 passed in 0.33s`.

- The 15 controller/weekly core files used by those tests are byte-identical across r20 frozen source, worktree, and the success clone where applicable.

- Success-clone installed runtime:
  ```text
  croniter_origin=.../3dab1a55-v150/venv/.../croniter/__init__.py
  croniter_version=6.0.0
  activation_origin=.../3dab1a55-v150/venv/.../checkin_cli/customer_admin.py
  validate_committed_activation_callable=True
  validated=True
  activation_validation_inputs_unchanged=true
  ```
  Candidate-wheel `checkin_cli/customer_admin.py` and success-clone installed bytes match exactly; the frozen croniter snapshot and clone bytes also match.

- Credential and launcher:
  - `.../runtime-authority/task26-candidate-digest`: mode `0400`, SHA-256 `6a58b0d6...`, content exactly equals candidate `3dab1a55...`.
  - `gateway.service` launches the success-clone `.../venv/bin/python -m hermes_cli.main --profile dualcoachtest`.
  - `authority.conf` binds `DUALCOACH_PROFILE_PACKAGE` and `LoadCredential=task26-candidate-digest` to that clone credential.

- Historical r17 is not reusable:
  ```text
  r17_consumed_status=CONSUMED
  r17_consumed_outcome=SUCCEEDED
  r17_approval_phrase_reusable=False
  ```
  Its package and candidate digests differ from r20; r20’s verifier also enforces the r17 non-reuse entry.

- Final r20 authority invariants remain absent:
  ```text
  r20_authorization_ledger=absent
  r20_execution_root=absent
  r20_live_successor_runtime=absent
  ```
  The only service command issued was read-only `systemctl --user show`; it reported the pre-existing service as `active/running` (PID `4024313`).