{
  "version": 1,
  "messageId": "b2274f15-232d-425c-89c3-ad74756e4a6d",
  "from": "lead",
  "to": "live-controller",
  "kind": "message",
  "body": "CONCRETE V2 REHEARSAL BLOCKED; repair exact receipt `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-rehearsal-v2/blocker-receipt.json` SHA `8a3a05acb12ff05d09628a8cf02b6326b38cdcb15828b1fd2194a796aa4c044c`. Three must-fix REDs: (1) install may not copy sealed/read-only current runtime into successor then mutate; use v7-equivalent fresh writable venv/install of exact wheels or normalize only successor permissions before install, preserving sealed current. (2) rollback remove_created must robustly chmod/unlink read-only trees, never mask primary exception, always restore/restart prior service; test PermissionError during install plus cleanup, secondary cleanup errors, and service restart. (3) off_smoke must parse absent `channel_inbox` as default OFF; deny only explicit/derived enabled, with exact live config fixture missing key. Preserve failed v2 preseal and blocker evidence. Build successor v3 package/preseal with new digest/phrase because controller/source seal changes; old 869c package/phrase becomes non-reusable. Run full concrete 35+ tests/static; no live/approval/network. STOP WHEN new frozen v3 is ready for fresh exact rehearsal.",
  "timestamp": 1787840079565
}