{
 "tool": "eclipse-crosslist-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-26",
 "bench_version": "0.1.0-rebench-r7-pollonly (scoped Phase 2 re-bench of the R7 poll fix ONLY; carried LOWs not re-benched)",
 "supersedes": "eclipse-crosslist-mcp-2026-10-26-3.json (scoped R1+R2 re-bench, PARTIAL \u2014 R7 medium) \u2014 retained unedited per append-only history; this card is the current verdict",
 "history": "append-only; fourth bench of eclipse-crosslist-mcp (scoped poll-only re-bench of the R7 fix)",
 "environment": "local (stdio/in-process, isolated mkdtemp fixture state for ALL bench harnesses) + builder suite/smoke re-run unmodified; real dogfood ledger verified READ-ONLY only; NO live writes anywhere",
 "builder_claims_verified": {
  "fix confined to t_ledger_poll ordinary branch (+25 lines): submitted->live/failed first passes shared _landing_identity_problem; on problem no transition, row stays submitted, eng.log_refusal MANIFEST_HASH_MISMATCH tool=ledger_poll, refusal entry in poll transitions": "TRUE \u2014 code-read (server.py t_ledger_poll gate block) + 37-case fresh bench battery: every identity-failing live/failed case behaved exactly so, on official + smithery + bazaar",
  "claimed path untouched (already gated inside _repair_submitted_row)": "TRUE \u2014 code-read (no change to _repair_submitted_row or the gate) + behaviour: claimed-hint identity-failing rows still decline via repair with zero receipts (R7-WV/FOREIGN/PART/ABSENT-CLAIMED), claimed-hint identity-passing rows still repair two-step (R7-CTRL-CLAIMED, REG-R2-STUCK-CLAIMED-REPAIR)",
  "gate itself unmodified": "TRUE \u2014 _landing_identity_problem code identical in shape to card-3 reading; R1 submit-gate spot (REG-R1-SUBMIT-FOREIGN) behaves exactly as card-3",
  "5 new R7 tests; suite 49/50, sole failure known ENV-CATALOG dogfood assert (79 vs real 80)": "TRUE \u2014 re-ran unmodified: 49/50, all 5 R7 tests PASS, sole FAIL is that assert; smoke SMOKE PASS; catalog counted directly = 80 products"
 },
 "checks": [
  {
   "id": "R7-WV-LIVE",
   "name": "wrong-version record w/ that version's real hash, hint=live",
   "verdict": "pass",
   "evidence": "hint=live: stays submitted, transition refusal MANIFEST_HASH_MISMATCH, logged refusal x1 (detail names 8.8.8/0.7.0: True), receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-WV-FAILED",
   "name": "wrong-version record w/ that version's real hash, hint=failed",
   "verdict": "pass",
   "evidence": "hint=failed: stays submitted, transition refusal MANIFEST_HASH_MISMATCH, logged refusal x1 (detail names 8.8.8/0.7.0: True), receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-WV-CLAIMED",
   "name": "wrong-version record w/ that version's real hash, hint=claimed",
   "verdict": "pass",
   "evidence": "hint=claimed: stays submitted via pre-existing repair gate (no refusal entry/log on claimed path \u2014 repair declines silently, as card-3 R2-S4), receipts 2->2, chain_valid=true, transitions=[{'registry_id': 'official', 'result': 'no change (observed claimed)', 'state': 'submitted', 'freshness': 'stale-check-overdue'}]"
  },
  {
   "id": "R7-FOREIGN-LIVE",
   "name": "foreign record (different product/name), hint=live",
   "verdict": "pass",
   "evidence": "hint=live: foreign name/version/hash evidence refused, stays submitted, refusal logged, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-FOREIGN-FAILED",
   "name": "foreign record (different product/name), hint=failed",
   "verdict": "pass",
   "evidence": "hint=failed: foreign name/version/hash evidence refused, stays submitted, refusal logged, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-FOREIGN-CLAIMED",
   "name": "foreign record (different product/name), hint=claimed",
   "verdict": "pass",
   "evidence": "hint=claimed: foreign evidence, repair gate declines, stays submitted, receipts 2->2, chain_valid=true (claimed path logs no refusal \u2014 pre-existing)"
  },
  {
   "id": "R7-PART-hash_only-live",
   "name": "partial evidence hash_only, hint=live",
   "verdict": "pass",
   "evidence": "hash_only/hint=live: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-hash_only-failed",
   "name": "partial evidence hash_only, hint=failed",
   "verdict": "pass",
   "evidence": "hash_only/hint=failed: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-ref_only-live",
   "name": "partial evidence ref_only, hint=live",
   "verdict": "pass",
   "evidence": "ref_only/hint=live: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-ref_only-failed",
   "name": "partial evidence ref_only, hint=failed",
   "verdict": "pass",
   "evidence": "ref_only/hint=failed: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-empty_ev-live",
   "name": "partial evidence empty_ev, hint=live",
   "verdict": "pass",
   "evidence": "empty_ev/hint=live: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-empty_ev-failed",
   "name": "partial evidence empty_ev, hint=failed",
   "verdict": "pass",
   "evidence": "empty_ev/hint=failed: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-lr_none-live",
   "name": "partial evidence lr_none, hint=live",
   "verdict": "pass",
   "evidence": "lr_none/hint=live: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-lr_none-failed",
   "name": "partial evidence lr_none, hint=failed",
   "verdict": "pass",
   "evidence": "lr_none/hint=failed: refused MANIFEST_HASH_MISMATCH (transition+log), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-hash_only-claimed",
   "name": "partial evidence hash_only, hint=claimed",
   "verdict": "pass",
   "evidence": "hash_only/hint=claimed: repair gate declines, stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-PART-lr_none-claimed",
   "name": "partial evidence listing_ref=None, hint=claimed",
   "verdict": "pass",
   "evidence": "lr_none/hint=claimed: repair gate declines, stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-ABSENT-LIVE",
   "name": "absent record, hint=live",
   "verdict": "pass",
   "evidence": "absent/hint=live: expected_identity=None -> refused, stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-ABSENT-FAILED",
   "name": "absent record, hint=failed",
   "verdict": "pass",
   "evidence": "absent/hint=failed: expected_identity=None -> refused, stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-ABSENT-CLAIMED",
   "name": "absent record, hint=claimed",
   "verdict": "pass",
   "evidence": "absent/hint=claimed: repair gate declines (expected None), stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-CTRL-LIVE",
   "name": "identity-passing control, hint=live",
   "verdict": "pass",
   "evidence": "lands live, +1 receipt (observed-live), receipts 2->3, chain_valid=true, no refusals"
  },
  {
   "id": "R7-CTRL-CLAIMED",
   "name": "identity-passing control, hint=claimed (two-step repair)",
   "verdict": "pass",
   "evidence": "two-step repair lands claimed, +2 repair receipts, exactly 1 submit-accepted, chain_valid=true"
  },
  {
   "id": "R7-CTRL-FAILED",
   "name": "identity-passing control, hint=failed",
   "verdict": "pass",
   "evidence": "lands failed, +1 receipt, receipts 2->3, chain_valid=true, no refusals"
  },
  {
   "id": "R7-XSMITHERY-LIVE",
   "name": "smithery non-official: wrong-version record, hint=live",
   "verdict": "pass",
   "evidence": "smithery hint=live: v9.1.0 track vs v2.0.0 record (real hash) refused, stays submitted, refusal logged, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-XSMITHERY-FAILED",
   "name": "smithery non-official: wrong-version record, hint=failed",
   "verdict": "pass",
   "evidence": "smithery hint=failed: v9.1.0 track vs v2.0.0 record (real hash) refused, stays submitted, refusal logged, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-XSMITHERY-CTRL-LIVE",
   "name": "smithery identity-passing control, hint=live",
   "verdict": "pass",
   "evidence": "smithery identity-passing lands live, +1 receipt, chain_valid=true"
  },
  {
   "id": "R7-XBAZAAR-ABSENT-FAILED",
   "name": "bazaar non-official: absent product, native failed hint",
   "verdict": "pass",
   "evidence": "bazaar native absent (hint=failed from observe): gate refuses submitted->failed, stays submitted, refusal transition+log, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-XBAZAAR-FOREIGN-LIVE",
   "name": "bazaar non-official: foreign product evidence, hint=live",
   "verdict": "pass",
   "evidence": "bazaar patched foreign product evidence (agent-ready-mcp vs track eclipse-agent-wallet-mcp) refused, stays submitted, receipts 2->2, chain_valid=true"
  },
  {
   "id": "R7-XBAZAAR-CTRL-LIVE",
   "name": "bazaar identity-passing control, hint=live",
   "verdict": "pass",
   "evidence": "bazaar identity-passing (product id eclipse-agent-wallet-mcp, catalog count 80) lands live, +1 receipt, chain_valid=true"
  },
  {
   "id": "R7-AFTERMATH",
   "name": "refusal idempotence + recovery after identity correction",
   "verdict": "pass",
   "evidence": "poll1 refusal (receipts 2, refusals-log 1), poll2 refusal (receipts still 2, refusals-log 2, state submitted, no drift), record corrected to v8.8.8 -> poll3 lands live (+1 receipt, chain_valid=true) \u2014 refusal does not brick"
  },
  {
   "id": "R7-NS-LIVE-CLAIMED",
   "name": "non-submitted: live->claimed legit",
   "verdict": "pass",
   "evidence": "live->claimed lands as card-3 (observed-claimed, +1 receipt), gate not invoked for non-submitted source"
  },
  {
   "id": "R7-NS-LIVE-CLAIMED-FOREIGN",
   "name": "non-submitted: live->claimed gate-leak probe (foreign evidence)",
   "verdict": "pass",
   "evidence": "live->claimed with FOREIGN evidence still lands claimed (+1 receipt, zero poll refusals) \u2014 gate does NOT leak into non-submitted sources (scoped fix, as tasked)"
  },
  {
   "id": "R7-NS-LIVE-FAILED",
   "name": "non-submitted: live->failed drift/removal",
   "verdict": "pass",
   "evidence": "live->failed on record absence (drift/removal) lands, +1 receipt observed-removed, chain_valid=true"
  },
  {
   "id": "R7-NS-CLAIMED-FAILED",
   "name": "non-submitted: claimed->failed",
   "verdict": "pass",
   "evidence": "claimed->failed on record absence lands, +1 receipt, chain_valid=true"
  },
  {
   "id": "R7-NS-TRACKED-NOOP",
   "name": "non-submitted: tracked no-op (native + patched live hint)",
   "verdict": "pass",
   "evidence": "tracked row: native poll no-op + patched-live-hint poll no-op, receipts unchanged (1), zero gate refusals"
  },
  {
   "id": "REG-R1-SUBMIT-FOREIGN",
   "name": "R1 spot: submit-gate identity refusal (foreign evidence)",
   "verdict": "pass",
   "evidence": "ledger_submit foreign evidence: MANIFEST_HASH_MISMATCH, acceptance_recorded=False, row tracked, 0 submit-accepted, chain_valid=true \u2014 R1 submit gate intact"
  },
  {
   "id": "REG-R2-CLAIMED-LIFECYCLE",
   "name": "R2 spot: claimed-at-submit lifecycle",
   "verdict": "pass",
   "evidence": "verify-namespace->publish->claim lands claimed, history ['tracked', 'submitted', 'live', 'claimed'], chain_valid=true \u2014 R2 claimed-at-submit intact"
  },
  {
   "id": "REG-R2-STUCK-CLAIMED-REPAIR",
   "name": "R2 spot: stuck-claimed repair via poll",
   "verdict": "pass",
   "evidence": "stuck submitted + claimed hint -> poll repair to claimed, repair causes present, exactly 1 submit-accepted, chain_valid=true"
  },
  {
   "id": "REG-SUITE",
   "name": "builder suite + smoke re-run unmodified",
   "verdict": "partial",
   "evidence": "tests/test_crosslist.py plain-python runner: 49/50 PASS incl. all 5 new R7 tests (test_r7_poll_live_hint_identity_failing_stays_submitted, live_hint_identity_passing_still_lands_live, failed_hint_identity_failing, failed_hint_identity_passing, claimed_hint_identity_failing); sole FAIL test_dogfood_79_products_tracked_and_served on hardcoded len==79 vs real 80-product catalog (ENV-CATALOG, external, card-3 \u2014 NOT a fix regression, not re-litigated). smoke.py: SMOKE PASS"
  },
  {
   "id": "DOGFOOD-LEDGER",
   "name": "real dogfood ledger untouched-proof (READ-ONLY)",
   "verdict": "pass",
   "evidence": "sha256 data/state.json=c74d00655f75ad9e2f4b49c1125c6d2431b35e5860dc6f9460632feccd9ec408 and data/ledger.jsonl=7b42479579241fa45f6d7a36b9914f0b41bfbc447927cd94f4a521a175bbe79e at bench start (== Phase-1 left values in the brief), after every harness, and at bench end \u2014 identical. Read-only counts: 79 tracks / 82 receipts (state == journal lines), chain_ok=true, verify_journal_chain=true, row states {live:1, tracked:78}, 0 stuck submitted rows. All bench harnesses ran on isolated mkdtemp fixture state; no live writes anywhere"
  },
  {
   "id": "ENV-CATALOG",
   "name": "catalog count current",
   "verdict": "pass",
   "evidence": "real bazaar catalog.json = 80 products at this bench (counted directly); Crosslist bazaar facet serves it (R7-XBAZAAR-CTRL-LIVE retrievable/live). Listing copy must use 80, never 79"
  }
 ],
 "fix_verdicts": {
  "R7": "CLOSED \u2014 ledger_poll's ordinary submitted->live AND submitted->failed branches now pass the shared _landing_identity_problem gate before any transition. Fresh shapes beyond the builder's 5 tests, all refused with row staying 'submitted', zero new state receipts, chain_valid=true throughout: foreign record (different product/name, real foreign hash), wrong-version record carrying THAT version's real hash (fresh v8.8.8 track vs v0.7.0 record, native live + patched failed), partial evidence (hash-only, ref-only, empty evidence list, listing_ref=None \u2014 each x live/failed), absent record (expected_identity=None, fabricated evidence, x live/failed). Cross-registry: smithery wrong-version refused x live/failed (builder tested official only); bazaar native absent-product failed-hint refused + patched foreign-product live-hint refused, bazaar identity-passing control lands live. Refusal aftermath: second poll re-refuses with zero receipt inflation and zero state drift (refusals-log grows by exactly the named refusal per poll \u2014 a log, not a receipt); after the record is made identity-correct the same row recovers and lands live \u2014 refusal does not brick the track. Identity-passing controls land exactly as pre-fix for every destination: live = receipted observed-live, claimed = two-step repair (repair-observed-live/claimed, exactly 1 submit-accepted), failed = submitted->failed receipted. Non-submitted sources are UNTOUCHED by the gate: live->claimed (legit AND a foreign-evidence leak-probe \u2014 the gate does not leak into non-submitted sources, by scoped design), live->failed drift/removal, claimed->failed, and tracked no-op (native + patched live hint, zero gate refusals) all behave exactly as card -3 recorded. R1/R2 regression SPOTS pass: submit-gate foreign refusal, claimed-at-submit lifecycle [tracked, submitted, live, claimed], stuck-claimed repair via poll",
  "R7_nuance_claimed_refusal_logging": "On the record, not a defect: for the CLAIMED destination hint, an identity-failing row stays submitted with zero receipts via the pre-existing repair gate, which declines SILENTLY \u2014 poll reports 'no change (observed claimed)' and writes no MANIFEST_HASH_MISMATCH refusal entry/log (verified in R7-WV/FOREIGN/PART/ABSENT-CLAIMED). The named-refusal logging shipped in this fix covers the live/failed ordinary branch \u2014 the only branch that could previously LAND a row falsely. The claimed path never could (card-3 R2-S4 was a PASS on exactly this behaviour), Phase 1 explicitly left it untouched, and the safety property (no false landing, no receipt, chain intact) holds on all three destinations. Recorded so no listing or parent summary over-claims 'refusal logged on every hint'",
  "carried_lows": "NOT re-benched this round per scope, status carried from card -3 unchanged: R3 (low, reduced \u2014 nested-envelope depth bound + error-shaped-data false positives), R8 (low \u2014 resubmit repair before mandate verification in _submit_one), R9 (low \u2014 native fixture observe returns 'unchanged' for record-absent submitted rows, so that native no-exit is unchanged by this fix: the gate only fires when the ordinary branch selects a destination; a native absent row still no-ops in poll), D5 (low, carried), D7 (low, carried \u2014 receipts sealable/pending, never sealed), D8 (low, carried, re-verified on card -3)"
 },
 "defects": [
  {
   "id": "R3",
   "severity": "low",
   "origin": "carried from card -3, NOT re-benched this round",
   "summary": "CARRIED-REDUCED: nested error envelopes detected to wrapper depth 3; depth >=4 and top-level list payloads escape; truthy error/errors data keys at depth <=3 refused (fail-closed false positives). No current route produces either shape"
  },
  {
   "id": "R8",
   "severity": "low",
   "origin": "carried from card -3, NOT re-benched this round",
   "summary": "CARRIED: resubmit-triggered repair runs before mandate verification in _submit_one (no registry write, no new submit-accepted; poll parity)"
  },
  {
   "id": "R9",
   "severity": "low",
   "origin": "carried from card -3, NOT re-benched beyond noting status",
   "summary": "CARRIED: stuck submitted row with entirely absent registry record has no native fixture exit (observe hint='unchanged', poll no-ops \u2014 unchanged by the R7 fix, which only gates selected live/failed destinations). Bricked-but-truthful"
  },
  {
   "id": "D5",
   "severity": "low",
   "origin": "carried from first bench, NOT re-verified this round",
   "summary": "CARRIED: README/manifest Herald drop-in claim overbroad for RSA keys. Fail-closed; listing copy must not repeat the claim (see listing conditions)"
  },
  {
   "id": "D7",
   "severity": "low",
   "origin": "carried from first bench, NOT re-verified this round",
   "summary": "CARRIED: receipts never sealed \u2014 seal.status='pending'. Certification covers sealable form only, never 'sealed'"
  },
  {
   "id": "D8",
   "severity": "low",
   "origin": "carried from first bench (re-verified on card -3), NOT re-benched this round",
   "summary": "CARRIED: mandate nonce consumed before facet dispatch \u2014 glama ledger_submit (VERB_ABSENT_NATIVE, no write) burns the nonce; later legitimate use false-positives MANDATE_REPLAY"
  }
 ],
 "per_facet_scopes": {
  "root+ledger": "CERTIFIED(local) \u2014 card-3's R7 bar LIFTED: submit side was already CERTIFIED(local) (identity-bound acceptance on every write facet, claimed-at-submit two-step, receipted identity-gated repair); poll side now matches \u2014 EVERY poll transition out of 'submitted' is identity-gated (live/failed via the new shared-gate block in t_ledger_poll, claimed via the pre-existing repair gate). Conditions R8/R9 (low). Root stays 10 tools; mandate/T3/nonce/chain gates held (suite + spots)",
  "official": "CERTIFIED(live-read) for list_servers/get_server/list_versions/get_version_detail (card-3, not re-run live this round); writes = CERTIFIED(fixture) with card-2 R1+R2 conditions lifted (card-3) and the R7 poll condition now LIFTED by this card; live writes honestly refuse REGISTRY_WRITE_UNAVAILABLE \u2014 NOT live-write certified",
  "smithery": "CERTIFIED(live-read) for search_servers/get_server ONLY (card-3); CERTIFIED(fixture) for hosting/install-counts/releases/connect sub-resources + publish/publish-release/deploy writes, with R1+R6 conditions lifted (card-3) and the R7 poll condition now LIFTED (this bench: smithery poll gate verified directly, live + failed hints + passing control); live sub-resources/writes refuse REGISTRY_WRITE_UNAVAILABLE \u2014 NOT live-write certified",
  "bazaar": "CERTIFIED(local) \u2014 real catalog through Crosslist (local-live), publish/status writes under mandate, R1 gate on the bazaar route (card-3); R7 poll condition LIFTED for bazaar too (this bench: native absent-product failed-hint refused, patched foreign-product live-hint refused, identity-passing control lands live). Identity = product id/name + record hash (no version field). Catalog = 80 products as of this bench",
  "glama": "CERTIFIED(fixture-read) all 8 verbs \u2014 unchanged, not re-benched this round; live stays fixture (401 known); ZERO write verbs; NOT live certified at any scope. D8 carried",
  "herald_dependency": "FIXTURE ONLY \u2014 carried: ECDSA P-256 Herald-fixture mandates; production Herald RSA-JWS not exercised; receipts Herald-SEALABLE, seal.status=pending \u2014 no 'sealed' claim certified anywhere"
 },
 "listing_readiness": {
  "statement": "CERTIFIED-at-scopes with only LOWs remaining (R3, R8, R9, D5, D7, D8 \u2014 all carried, none re-opened, no new MEDIUM+ found in the fix code). LISTING-READY",
  "name": "Eclipse Crosslist \u2014 unchanged; owner name ratification remains the parent's open item and does not block this verdict",
  "required_wording": [
   "Per-facet scopes exactly as in per_facet_scopes above (live-read vs fixture distinctions for official/smithery; glama fixture-read only; herald FIXTURE ONLY)",
   "Poll reconciliation out of 'submitted' may now be worded as identity-bound: ledger_poll applies NO transition out of 'submitted' (live, claimed, or failed) unless the observed record identifies the submitted artifact (name + version + payload hash; bazaar: product id/name + record hash) \u2014 the card-3 R7 wording restriction is LIFTED. Do NOT extend this to a version-landing claim beyond what the gate proves: a landed receipt proves the observed record matched the submitted artifact's identity at poll time, nothing about live registries (all poll evidence here is fixture/local)",
   "Receipts are Herald-SEALABLE with seal.status pending \u2014 the word 'sealed' must not appear (D7)",
   "No live-write claim for any facet; live facets are live-READ only as benched \u2014 no live writes exist or were exercised",
   "Listing copy must not repeat the Herald drop-in sentence from README.md:101 / bazaar-manifest.json:85 (D5) \u2014 say ECDSA P-256 fixture verification, production RSA-JWS not exercised; the D5 Herald drop-in sentence must not appear in listing copy",
   "Bazaar catalog count is 80 (never 79) \u2014 do not republish the stale 79-product dogfood wording without re-running dogfood against the current catalog"
  ]
 },
 "qualifier": "split per facet \u2014 see per_facet_scopes",
 "verdict": "CERTIFIED-at-scopes (split per facet) \u2014 R7 CLOSED under a 37-case fresh poll-only battery (official battery x live/claimed/failed, smithery + bazaar cross-registry spots, refusal aftermath/recovery, non-submitted leak checks, R1/R2 regression spots), builder suite 49/50 (sole failure = known external ENV-CATALOG 79-vs-80 assert), smoke PASS, real ledger read-only proof intact. Only LOWs stand (R3/R8/R9/D5/D7/D8, carried, not re-benched). LISTING-READY subject to the listing conditions in listing_readiness.required_wording",
 "notes": [
  "Bench method: code-read of the Phase-1 diff surface (t_ledger_poll gate block; _repair_submitted_row and _landing_identity_problem unchanged), builder suite + smoke re-run unmodified, ONE fresh hostile harness (37 cases) on isolated mkdtemp fixture state with fresh names/versions distinct from the builder's (track v8.8.8 vs record v0.7.0; smithery v9.1.0 vs v2.0.0; foreign io.github.otherclone), chain + receipt-count checks after every case, and READ-ONLY real-ledger verification with start/end sha256 comparison. Wave-3 discipline applied to the fix code itself: destinations x evidence variants matrix, cross-registry spots the builder did not test, aftermath/recovery, and gate-leak probes on non-submitted sources",
  "One bench-harness error corrected during the run, on the record: the first harness run scored 34/37 \u2014 all 3 failures were harness bugs (repair receipt causes are the full strings 'repair-observed-live via poll'/'repair-observed-claimed via poll', asserted as exact members; one status-indexing error). Harness fixed, FULL battery re-run fresh: 37/37 PASS. No product code was touched by this bench at any point",
  "What the R7 fix genuinely bought, stated plainly: the last ungated landing path is closed. Card-3's false-live wire proof (v9.9.9 track landed on a v1.0.0 record's hash through poll) is now refused by name on every destination the ordinary branch can select, on every write facet benched, and the refusal is recoverable \u2014 fix the record and the same track lands. The fix is exactly as small as claimed and leaks nowhere: non-submitted transitions are byte-for-byte in behaviour what card-3 recorded, including a deliberate foreign-evidence live->claimed probe that still lands (the gate's scope is 'submitted' rows only, as tasked \u2014 that probe documents scope, it is not a defect)"
 ]
}