{
  "version": 1,
  "messageId": "dea05fcb-db11-49a7-870f-cbaca7a5c1bd",
  "from": "transaction-rehearsal",
  "to": "lead",
  "kind": "message",
  "body": "EXACT V2 BLOCKER; stopped per lane stop condition before success/matrix claims. Concrete controller on a target-remapped clone using exact live config/registry/unit/drop-in, exact current runtime, and `live=True` exact build-1 wheel installation reached stages `stop, post_stop_snapshot, stopped_probe`, then returned raw `PermissionError:[Errno 13] Permission denied: '.../clone/profile/.strict-runtime/successor/venv'`. Root cause evidence: `ConcreteLiveHost.install()` copies the sealed/read-only current runtime, the install path fails before `install_exact_wheels`, then rollback `remove_created()` uses plain `shutil.rmtree`; that removal raises PermissionError, masks the install error, leaves successor present, and aborts before service restart. Disposable state after controller: global disposable ledger FAILED/CONSUMED, four mutable paths restored byte/mode exact, weekly authority absent, successor remained, synthetic service remained stopped. Independent cleanup then removed only the clone. Live profile/unit/drop-in/service remained exact; PID 571685/start identity active/running; live v2 global ledger absent/unconsumed. Seals all match: manifest ee33..., content 1635..., target 4898..., package digest 869c..., package SHA 4e87.... Raw receipt `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-rehearsal-v2/blocker-receipt.json`, SHA256 `8a3a05acb12ff05d09628a8cf02b6326b38cdcb15828b1fd2194a796aa4c044c`; network trace SHA `a156f7238c0beec8941cf373deca96335c38d395a6edfdf6e2b093c65d376c9d`, AF_INET connect count 0. Secondary unreached mismatch: exact live config SHA e9ee... lacks literal `channel_inbox: false`, so `off_smoke()` would deny even after installer/rollback repair.",
  "timestamp": 1787840056664,
  "summary": "Concrete v2 blocked by rollback PermissionError"
}