I read this as a read-only authority/rollback audit - I’ll inspect the implementation, tests, and rehearsal evidence, run the two scoped tests once, then return one unconditional verdict with exact references and blocker_count.


I’ve traced the transaction and authority paths; the scoped tests exercise paired-WAL recovery, exact state cardinality, denial paths, publication interruptions, and both rollback boundaries. I’m now running the two requested test files once, then I’ll reconcile their assertions against the rehearsal report and implementation invariants.


I read this as the final read-only audit verdict - I verified the full matrix against implementation, scoped tests, and rehearsal evidence.

# UNCONDITIONAL PASS

`blocker_count: 0`

- **WAL paired append/recovery:** intent is durably written before paired publication and removed only after verification (`task26_runtime_authority.py:604-680, 730-782`). Registry and ledger interruption boundaries recover successfully (`test_nutricoach_v150_v15_authority_adversarial.py:103-147`).
- **N/N+1/N+2 enforcement:** promotion permits exactly N→N+1 (`nutricoach_v150_concrete_host.py:587-612`); rollback permits unchanged N or compensating N+2 only (`:696-719`). Tests confirm rollback reaches event count 4 from the two-event baseline (`test_nutricoach_v150_v15_safety.py:103-108`; adversarial test `:182-185, 200-203, 212-215`).
- **Stale/revoked/replay denial:** stale pin (`adversarial.py:86-100`), revoked candidate through both production loader and direct verifier (`:233-248`), and consumed replay without registry/ledger mutation (`:220-230`) all pass. Runtime checks are fail-closed at `task26_runtime_authority.py:253-258, 283-310`.
- **Registry/ledger/pin/credential interruption:** registry and ledger replacements are independently interrupted (`adversarial.py:103-147`); authority-pin and candidate-digest credential writes are independently interrupted and rolled back (`:150-187`).
- **Precommit/postcommit rollback:** precommit switch failure (`:190-203`) and committed Manual-QA rollback (`:206-217`) restore predecessor authority. Rollback ordering restores authority, snapshots, created paths, systemd state, service, and protected state (`nutricoach_v150_sealed_controller.py:94-135, 238-252`).
- **Predecessor pin/service restoration:** rollback appends predecessor qualification, regenerates the pin, and validates it through the production loader (`nutricoach_v150_concrete_host.py:682-735`). Service-running and successor-removal assertions are at `adversarial.py:186-187, 216-217`.
- **No rewind/revoke policy:** rollback is a forward append of predecessor `qualify`, not truncation or successor revocation (`nutricoach_v150_concrete_host.py:698-709`). Paired chains remain append-only and cross-bound (`task26_candidate_authority.py:184-234, 314-377`).
- **Evidence distinction:** authority conclusions above are **production-loader assertions**, notably `v15_safety.py:46-58, 91-108` and `adversarial.py:67-83, 182-185, 200-203, 212-215, 245-248`. Credential bytes are generated canonically at `nutricoach_v150_host_operations.py:146-170`; rollback intentionally regenerates new N+2 pin bytes rather than restoring stale N bytes. The scoped direct byte-equality assertion is for replay-preserved registry/ledger history (`adversarial.py:223-230`), not credential identity.
- **Rehearsal:** `report.json:1` records `status=PASS`, all 13 cases passing, `external_events=0`, and `live_source_unchanged=true`. Rehearsal rollback checks exact mutable bytes, active predecessor service, removed successor artifacts, zero external events, and replay denial (`rehearse_nutricoach_v150_v15.py:220-261`).

Verification:

```text
PYTHONPATH="$PWD:$PWD/dualcoach/profile" .venv/bin/pytest --import-mode=importlib -q \
  tests/test_nutricoach_v150_v15_safety.py \
  tests/test_nutricoach_v150_v15_authority_adversarial.py

11 passed in 5.38s
```

No files or live authority were modified.