# MEOK release consolidation and replay-integrity correction **Observed 11 November 2026.** This is a bounded update to the existing receiver/public-research release, not a claim that all MEOK functions, source adapters, human journeys or 100 research candidates are complete. ## Result that changed The published reproduction runner checked downloaded base-source hashes but copied three local presentation files into execution without checking their identities. Its final message also asserted 18 controls without checking the actual discovery count. In an isolated control, replacing only the local test file with a comment produced `Ran 0 tests`, exit 0, and the old `PASS: 18 presentation controls` message. This is a reproduced verifier defect, not evidence that the earlier genuine 18-test records were false. The corrected runner checks and captures all three exact local files before network access or execution. Downloaded source and its manifest remain hash-bound. It rejects unsupported paths, non-regular/symlink inputs, oversized files and malformed manifests. It executes the captured bytes rather than rereading mutable source paths, requires exactly 18 tests, and refuses skips, expected failures and zero-test success. No private runtime, model, signed evidence or production permission was changed. The corrected original-source replay passed all 18 controls. The zero-test replacement was refused before execution. Twenty-six new offline regression tests passed locally and on the existing M4; these are the same tests rerun, not 52 independent tests. Three actual before/after scenarios are retained separately. ## Mobile workflow correction A real public-browser run completed inference, JSON export and retained replay, but the populated results widened the page at 390 pixels. The CSS-only correction allows grid children to shrink and retains each table inside its existing scroll container. The tested candidate passes 24 checks across 1280-pixel desktop and 390-pixel mobile widths, including existing inference/export/replay, navigation to the precision lab, the historical receiver report and this update. Candidate-browser checks substitute staged assets into the live origin; they are not the subsequent published-byte acceptance. ## Concurrent publication reconciled Before upload, the exact-parent guard detected public revision `a13446a1d33a3ca33a2141a62dff70d848c87551`. That owner had published an equivalent mobile containment fix, current-result UI protection and the master release navigation. This lane withdrew its unshipped CSS and preserved those exact current files. The earlier candidate-browser record remains a staged result; final served checks must qualify the combined release. The narrower public replay-integrity repair and this dated audit are the only remaining changes from this lane. The existing master consolidation is at `../../../release-20261111/index.html`; this receiver audit is an additive source/evidence update, not a competing root dashboard. ## What is currently qualified The existing private receiver was freshly exercised on source and serving revision `4bcd42b2e9dcb579e973e59219c6548c5d1fec44`. Thirteen account-authenticated MCP calls returned six normal responses and seven expected refusals. Event identities, review hashes, receiver UTC, abstention and recovery passed; all eight aggregate integrity assertions passed. No model provider, saved-copy operation, hardware change or signature was invoked. The categorical receiver remains canonical source `37edcea4dba1f7e42ad686f95e9d4860b64aeb38`. PR #4180 current head `7409b6f1c0c62943cca9b83b8a47453ae050d68b` has 16 latest named checks successful at this readback and is ready for owner review, not merged. Historical cancelled/superseded runs do not turn the current successful checks into failures, and an old green head is not substituted for a new head. The public v0.2 and v0.3 labs, learned checkpoints, datasets and prior receiver-UI repair remain in place. They are research consumers. Replaying their retained rows is not new training or a blinded evaluation. The original process model's low mean error coexists with a large worst-case error; it is not a general-world-model or safety qualification. The broader 100-candidate work remains source/metadata screening with selected deeper slices and experiments, not 100 adopted integrations or security audits. ## Source, time and state stay separate MEOK coordinates work; the existing authority path controls effects; the dependency view retains relationships and corrections; measurement checks the bounded outcome. A current UI, a matching hash, a successful model call, a human decision, observed execution, recipient acceptance and payment are separate facts. Source packaging has advanced in the existing runtime. Its saved-copy records explicitly say source-qualified with hosted persistence acceptance still required. This pass does not upgrade that status merely because the Space is RUNNING. It did not access stored conversations or write, restore, remove or migrate any saved user data. Public HTML receives additional host-supplied metadata. Raw HTML hashes therefore differ from repository bytes; original application/script/data assets must be checked separately, and the host additions must be inspected rather than discarded with an unrestricted normalization rule. The existing public evidence files checked in this audit remained exact byte matches. This is not a guarantee of all future responses. ## Dependency-ordered work after this release 1. Complete the post-publication byte and reader checks for this repair; preserve failure controls and the historical originals. 2. Bind expected pins and current source/access state through the existing authenticated host, not caller assertions. Test source correction, withdrawal and revision changes before trusting reuse. 3. Qualify one harmless real approval-to-effect journey. The reviewer must genuinely accept scope and identity; separately observe the effect and reproduce refusal for expiry, revocation and replay. 4. Let the persistence owner qualify actual lifecycle recovery and per-account isolation with explicit consent. Do not restart or mutate storage merely to make a report green. 5. Improve capability using separate development and fresh held-out episodes. Preserve the earlier 219-request pilot; show invalid-answer coverage and tail failures, not parsed-only scores. Use the deterministic reference when it solves the exact rule, and assign models a useful interpretation task. 6. Evaluate complementarity and selective reuse on whole workflows: rescued errors minus introduced errors, stale results, latency, cost and human review effort. Shared agreement is not independent evidence. The finite 3 KB view references external information; it is not unlimited lossless storage. 7. Treat photonic CPU compatibility, physical hardware qualification and commercial pilot terms separately. No pilot terms, new account or paid hardware request was accepted here. 8. Keep canonical source review, protected merge, deployment, signing and formal measurement admission with the existing owners. These steps form the machine-readable acyclic plan beside this report. They are proposed acceptance work, not an automatic promotion queue. No new scheduler, duplicate Space, trained checkpoint, user-memory store or authority service was created. ## Reproduce this exact repair Download the files from this directory and its parent at the published revision. Run `python3 -B -m unittest -v test_reproduction_integrity` in the parent directory for the 26 offline runner tests. Run `python3 -B reproduce_public.py` for the 18 original presentation controls; that command retrieves only its fixed public source set and verifies all declared pins before executing the captured code. Hashes are integrity references, not signatures, ownership proof, legal certification, independent reviewer acceptance or financial valuation. This report makes no universal 100-percent-correctness promise. The exact tested scope, sources, failures and remaining requirements are the qualification. ## Actual published acceptance The repaired public runner was downloaded from `34773cafd575fb138dffdf1b506e9fbb8c1a952c` into a clean directory: all 26 integrity tests and all 18 original presentation controls passed. The final composed browser check at `2fc4b58d2d38f12a9e29ea9dc91293fda4d62af9` passed 24 desktop/mobile checks with no network interception, including actual exported-JSON equality and retained-bank replay. Current exact code/data bytes and reader links were verified. Details are in `post-publication.json`. Concurrent owner navigation and presentation changes remain intact. This follow-up adds evidence and status links only.