I read this as a system-boundary investigation - I’ll trace the launcher, writable bind set, preflight worker, and authority loader, then report three contract-level causes with one decisive read-only query each.


I read this as a system-boundary investigation - I traced the sealed launcher, preflight ordering, and exact r24 wheel without modifying anything.

### 1. Sandbox mount-policy mismatch — confirmed, primary boundary failure

- **Exact boundary:** host filesystem → Bubblewrap mount namespace.
- **Violated contract:** every path mutated by code running inside the immutable sandbox must fall beneath an explicit writable bind.
- The launcher makes `/` read-only and binds only:
  - `/home/cube/.hermes/profiles/dualcoachtest`
  - `/home/cube/.config/systemd/user`
  - `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined`
- The resolved lock is `/home/cube/.hermes/runtime-authority/dualcoach-v1.3.0-owner-risk-first-customer/runtime-authority.lock`, outside all three.

**Decisive read-only query:**
```bash
rg -n -- '"--ro-bind"|"--bind"|runtime-authority' \
  /home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-preseal-v15-runtime-authority-r24/controller-source/scripts/execute_nutricoach_v150_sealed_live.py \
  /home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-preseal-v15-runtime-authority-r24/sealed-target.json
```

### 2. Preflight lifecycle violation — confirmed

- **Exact boundary:** read-only `capture_preflight` phase → first authorized mutation phase.
- **Violated contract:** preflight must observe and validate state only; mutation begins after `GlobalLedger.reserve()` and recovery setup.
- `_execute()` calls `host.capture_preflight()` before constructing/reserving the ledger. That method calls `_capture_runtime_authority()`, which invokes the production loader. Thus an authority-store metadata mutation occurs before the controller reaches its mutation boundary.

**Decisive read-only query:**
```bash
rg -n 'host\.capture_preflight|ledger\.reserve|host\.stop|load_task26_production_authority' \
  /home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-preseal-v15-runtime-authority-r24/controller-source/scripts/{nutricoach_v150_sealed_controller.py,nutricoach_v150_concrete_host.py}
```

### 3. Production-loader API contract violation — confirmed immediate trigger

- **Exact boundary:** `load_task26_production_authority()` → `FileCandidateAuthoritySource.__init__()`.
- **Violated contract:** loading/verifying an existing authority must be read-only and idempotent when its lock already satisfies the required invariant.
- The exact r24 wheel unconditionally executes `self.lock_path.chmod(0o600)` after checking/creating the lock. The existing lock is already owner-owned, single-link, and mode `0600`; nevertheless, `chmod(2)` is attempted against Bubblewrap’s read-only root and returns `EROFS`/Errno 30.

**Decisive read-only query:**
```bash
python -B - <<'PY'
import json, pathlib, stat, zipfile

wheel = pathlib.Path(
    "/home/cube/projects/richard/traning coach/.omo/evidence/"
    "nutricoach-v150-combined/task-v15r24-candidate/artifacts/build-1/"
    "hermes_agent-0.17.0-py3-none-any.whl"
)
target = json.loads(pathlib.Path(
    "/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/"
    "live-transaction-preseal-v15-runtime-authority-r24/sealed-target.json"
).read_text())
pin = json.loads(pathlib.Path(
    target["authority_baseline"]["pin_path"]
).read_text())
lock = pathlib.Path(pin["authority_root"]) / "runtime-authority.lock"

with zipfile.ZipFile(wheel) as archive:
    lines = archive.read(
        "gateway/platforms/task26_runtime_authority.py"
    ).decode().splitlines()
    for number in range(211, 221):
        print(f"{number}: {lines[number - 1]}")

info = lock.stat(follow_symlinks=False)
print(lock)
print("mode", oct(stat.S_IMODE(info.st_mode)),
      "uid", info.st_uid, "nlink", info.st_nlink)
PY
```

The immediate failure is cause 3, exposed by cause 2, and made fatal by cause 1. No mutation roots are reached.