I read this as a final read-only onboarding audit - I will run the required extracted-wheel bootstrap gate and inspect each requested boundary without modifying the workspace.


I read this as a read-only r36 release audit - I’ll run the exact six-test extracted-wheel bootstrap gate against r36, inspect its assertions and safety boundaries, then return an unconditional pass or counted blockers.


I found a potential intermediate-directory symlink bypass outside the six-test gate; I’m confirming it only in disposable extracted-wheel fixtures before issuing the verdict.


I read this as a read-only r36 audit - the six-test gate passes, but symlink/private-boundary defects block release.

**BLOCKERS: 3**

1. Intermediate `profile/data` symlinks are followed by `RoomBootstrapStore`; a disposable extracted-wheel run created `outside/onboarding/.../ledger.json`.
2. Intermediate `profile/customers` symlinks are followed by registration; it successfully registered into the symlink target.
3. Registration accepts unsafe existing modes (`profile`/`customers` `0755`, registry `0644`) and only partially tightens them after writing.

The exact extracted-wheel bootstrap gate passed: **6 passed in 0.69s**. It confirms disabled-row fields, single-use DM claim, consent/activation binding, and mocked recovery publication. r36 also removes the erroneous `trainer: null` field.

No live profiles were written and no Telegram messages were sent; all execution was under `/tmp`, and the candidate checksum remained unchanged.