From 5221f79e3f4170c95b484c71fdf702928ead1c69 Mon Sep 17 00:00:00 2001
From: Yun Chan <yunchan@twentyoz.kr>
Date: Sun, 9 Aug 2026 18:22:03 +0900
Subject: [PATCH] =?UTF-8?q?G7=20=EC=A6=9D=EB=AA=85=EA=B3=BC=20G8=20clean-h?=
 =?UTF-8?q?ead=20=EC=8A=B9=EA=B2=A9=20=EC=A4=80=EB=B9=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/api/app/config.py                        |   2 +-
 apps/api/app/routes/voice.py                  |  10 +-
 apps/api/app/services/session_metrics.py      |   4 +-
 apps/api/app/services/voice.py                |   2 +-
 apps/api/app/session_read_model.py            |  11 +-
 apps/api/app/test_session_read_model.py       |  49 +
 apps/api/app/test_voice_service.py            |   6 +-
 apps/api/app/test_voice_ws.py                 |  22 +
 apps/api/requirements.txt                     |   2 +
 apps/web/e2e/admin.spec.ts                    |  34 +-
 apps/web/e2e/dev-dashboard.spec.ts            |  33 +-
 .../e2e/self-directed-learning-loop.spec.ts   |  54 +
 apps/web/e2e/session-mvp.spec.ts              |  30 +
 apps/web/e2e/session-persistence.spec.ts      |  19 +
 apps/web/e2e/session-review-fixture.ts        |   7 +
 apps/web/e2e/session-review.spec.ts           |  11 +-
 apps/web/index.html                           |  80 +-
 docs/HANDOFF.md                               | 552 ++++++++++-
 docs/TODO.md                                  |  92 +-
 docs/decisions/local-voice-stack.md           |  12 +
 docs/dev_dashboard.html                       |  77 +-
 docs/guides/local-development.md              |  27 +-
 docs/guides/testing.md                        |  20 +-
 docs/ops/backlog-2026-06-26.md                |  62 +-
 ...an-head-material-milestone-2026-08-09.json |  33 +
 .../nas-preview-g8-rollback-proof-runbook.md  |   2 +-
 ...-g7-external-proof-readiness-2026-08-07.md |  44 +-
 docs/ops/public-runtime-watchdog.md           | 289 ++++--
 scripts/boot-public-runtime.ps1               | 122 ++-
 scripts/capture-g7-topology-evidence.py       | 926 +++++++++++++++++-
 scripts/check-dev-dashboard-ssot.py           |   4 +-
 scripts/check-g7-external-proof.py            | 575 ++++++++++-
 scripts/install-public-runtime-task.ps1       |  82 +-
 scripts/local-whisper-stt-server.py           |   4 +-
 scripts/melotts-server.py                     |   1 +
 scripts/probe-public-voice-sidecars.py        | 282 ++++++
 scripts/register-boot-task.ps1                |  97 +-
 scripts/run-g7-external-proof-window.py       | 288 +++++-
 scripts/run-outcome-os-release-agent.py       | 333 ++++++-
 scripts/start-local-whisper-stt.ps1           |   4 +-
 scripts/start-public-runtime.ps1              | 796 ++++++++++++++-
 scripts/test_g7_external_proof.py             | 276 ++++++
 scripts/test_g7_topology_evidence.py          | 360 +++++++
 scripts/test_local_whisper_stt_server.py      |   6 +-
 scripts/test_melotts_server.py                |   2 +
 scripts/test_outcome_os_release_agent.py      | 380 ++++++-
 ...test_public_runtime_watchdog_provenance.py | 408 ++++++++
 scripts/test_public_voice_sidecar_probe.py    | 144 +++
 scripts/test_run_g7_external_proof_window.py  | 227 ++++-
 scripts/test_start_public_runtime_contract.py | 331 +++++++
 scripts/watch-public-runtime-hidden.vbs       |  37 +-
 scripts/watch-public-runtime.ps1              | 111 ++-
 52 files changed, 6876 insertions(+), 506 deletions(-)
 create mode 100644 apps/api/app/test_session_read_model.py
 create mode 100644 docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json
 create mode 100644 scripts/probe-public-voice-sidecars.py
 create mode 100644 scripts/test_public_runtime_watchdog_provenance.py
 create mode 100644 scripts/test_public_voice_sidecar_probe.py
 create mode 100644 scripts/test_start_public_runtime_contract.py

diff --git a/apps/api/app/config.py b/apps/api/app/config.py
index bbc4051..be9673b 100644
--- a/apps/api/app/config.py
+++ b/apps/api/app/config.py
@@ -153,7 +153,7 @@ class Settings(BaseSettings):
         validation_alias="VIGNETTE_LOCAL_WHISPER_STT_URL",
     )
     local_whisper_stt_model: str = Field(
-        default="large-v3",
+        default="small",
         validation_alias="VIGNETTE_LOCAL_WHISPER_STT_MODEL",
     )
     local_whisper_stt_language: str = Field(
diff --git a/apps/api/app/routes/voice.py b/apps/api/app/routes/voice.py
index 430bc6e..ea7a229 100644
--- a/apps/api/app/routes/voice.py
+++ b/apps/api/app/routes/voice.py
@@ -206,9 +206,13 @@ async def voice_health() -> JSONResponse:
         "stt_model": voice_service.stt_model(),
         "stt_batch_fallback_available": voice_service.batch_stt_available(),
         "tts_model": (
-            voice_svc.HIGGS_TTS_MODEL
-            if tts_provider == "higgs"
-            else voice_svc.TTS_MODEL
+            voice_svc.MELOTTS_TTS_MODEL
+            if tts_provider == "melotts"
+            else (
+                voice_svc.HIGGS_TTS_MODEL
+                if tts_provider == "higgs"
+                else voice_svc.TTS_MODEL
+            )
         ),
         "tts_provider": tts_provider,
         "limits": {
diff --git a/apps/api/app/services/session_metrics.py b/apps/api/app/services/session_metrics.py
index d457804..66b0316 100644
--- a/apps/api/app/services/session_metrics.py
+++ b/apps/api/app/services/session_metrics.py
@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Any, Callable
 
 from ..store import InProcSession
@@ -44,7 +44,7 @@ class LearnerGrowthMetrics:
 def iso_datetime(ts: float | None) -> str | None:
     if ts is None:
         return None
-    return datetime.fromtimestamp(ts).isoformat(timespec="seconds")
+    return datetime.fromtimestamp(ts, tz=timezone.utc).isoformat(timespec="seconds")
 
 
 def session_activity_time(sess: InProcSession) -> float:
diff --git a/apps/api/app/services/voice.py b/apps/api/app/services/voice.py
index 7793111..e6df39c 100644
--- a/apps/api/app/services/voice.py
+++ b/apps/api/app/services/voice.py
@@ -998,7 +998,7 @@ class VoiceService:
             local_whisper_stt_model
             if local_whisper_stt_model is not None
             else settings.local_whisper_stt_model
-        ).strip() or "large-v3"
+        ).strip() or "small"
         self._local_whisper_stt_language = (
             local_whisper_stt_language
             if local_whisper_stt_language is not None
diff --git a/apps/api/app/session_read_model.py b/apps/api/app/session_read_model.py
index 7d9caf1..fb37b48 100644
--- a/apps/api/app/session_read_model.py
+++ b/apps/api/app/session_read_model.py
@@ -10,7 +10,7 @@ from __future__ import annotations
 import re
 from collections import Counter
 from dataclasses import dataclass
-from datetime import datetime
+from datetime import datetime, timedelta, timezone
 from typing import Any, Literal, Optional, cast
 
 from pydantic import BaseModel, Field
@@ -31,6 +31,7 @@ WorksheetItemSpec = tuple[str, str, list[str], WorksheetSpeaker | None]
 WorksheetSectionSpec = tuple[str, str, list[WorksheetItemSpec]]
 
 LEARNER_VISIBLE_AI_ROLE = "counselor"
+KOREA_STANDARD_TIME = timezone(timedelta(hours=9), name="KST")
 MISSING_SESSION_EVALUATION_GRACE_SECONDS = 30.0
 MISSING_SESSION_EVALUATION_ERROR = (
     "회기말 평가가 제한 시간 이후에도 저장되지 않았습니다. AI 평가 재시도가 필요합니다."
@@ -478,7 +479,11 @@ def stage_label(stage: object) -> StageLabel:
 def iso(ts: float | None) -> str | None:
     if ts is None:
         return None
-    return datetime.fromtimestamp(ts).isoformat(timespec="seconds")
+    return datetime.fromtimestamp(ts, tz=timezone.utc).isoformat(timespec="seconds")
+
+
+def session_calendar_date(ts: float) -> str:
+    return datetime.fromtimestamp(ts, tz=KOREA_STANDARD_TIME).strftime("%Y-%m-%d")
 
 
 def learner_visible_turns(sess: InProcSession) -> list[TurnRecord]:
@@ -1757,7 +1762,7 @@ def build_session_review(read_input: SessionReviewReadInput) -> SessionReviewRes
             initial=client_initial,
             persona=_persona_label(sess.persona_code, str(sess.persona.difficulty)),
         ),
-        date=datetime.fromtimestamp(sess.created_at).strftime("%Y-%m-%d"),
+        date=session_calendar_date(sess.created_at),
         durationLabel=_duration_label(duration_seconds),
         durationSeconds=duration_seconds,
         reachedPhase=reached_phase,
diff --git a/apps/api/app/test_session_read_model.py b/apps/api/app/test_session_read_model.py
new file mode 100644
index 0000000..85e7d38
--- /dev/null
+++ b/apps/api/app/test_session_read_model.py
@@ -0,0 +1,49 @@
+"""회기 읽기 모델의 시간 직렬화 계약 테스트."""
+
+from __future__ import annotations
+
+import unittest
+from datetime import datetime, timezone
+
+from .session_read_model import iso, session_calendar_date
+from .services.session_metrics import iso_datetime
+
+
+class SessionReadModelIsoTest(unittest.TestCase):
+    def test_none_remains_none(self) -> None:
+        self.assertIsNone(iso(None))
+
+    def test_epoch_is_serialized_as_utc_with_offset(self) -> None:
+        self.assertEqual(iso(0), "1970-01-01T00:00:00+00:00")
+
+    def test_timestamp_round_trips_without_local_timezone_drift(self) -> None:
+        timestamp = 1_800_000_120.0
+
+        rendered = iso(timestamp)
+
+        self.assertIsNotNone(rendered)
+        assert rendered is not None
+        parsed = datetime.fromisoformat(rendered)
+        self.assertEqual(parsed.tzinfo, timezone.utc)
+        self.assertEqual(parsed.timestamp(), timestamp)
+
+    def test_serialized_timestamp_has_explicit_utc_suffix(self) -> None:
+        rendered = iso(1_800_000_120.0)
+
+        self.assertIsNotNone(rendered)
+        assert rendered is not None
+        self.assertTrue(rendered.endswith("+00:00"))
+
+    def test_dashboard_metrics_use_the_same_utc_contract(self) -> None:
+        timestamp = 1_800_000_120.0
+
+        self.assertEqual(iso_datetime(timestamp), iso(timestamp))
+
+    def test_review_calendar_date_uses_korea_standard_time(self) -> None:
+        utc_late_afternoon = datetime(2026, 8, 8, 15, 30, tzinfo=timezone.utc)
+
+        self.assertEqual(session_calendar_date(utc_late_afternoon.timestamp()), "2026-08-09")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/apps/api/app/test_voice_service.py b/apps/api/app/test_voice_service.py
index 05042b4..daf7c3c 100644
--- a/apps/api/app/test_voice_service.py
+++ b/apps/api/app/test_voice_service.py
@@ -693,7 +693,7 @@ class LocalWhisperStreamingTest(unittest.IsolatedAsyncioTestCase):
         query = parse_qs(urlsplit(url).query)
         self.assertEqual(urlsplit(url).scheme, "ws")
         self.assertEqual(urlsplit(url).hostname, "127.0.0.1")
-        self.assertEqual(query["model"], ["large-v3"])
+        self.assertEqual(query["model"], ["small"])
         self.assertEqual(query["language"], ["ko"])
         self.assertEqual(query["sample_rate"], ["16000"])
         self.assertEqual(query["channels"], ["1"])
@@ -701,7 +701,7 @@ class LocalWhisperStreamingTest(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(query["utterance_end_ms"], ["1200"])
 
         self.assertEqual(result.text, "안녕하세요")
-        self.assertEqual(result.model, "large-v3")
+        self.assertEqual(result.model, "small")
         self.assertEqual(result.language, "ko")
         self.assertEqual([word.word for word in result.words], ["안녕하세요"])
         self.assertAlmostEqual(result.words[0].start, 0.05, places=3)
@@ -927,7 +927,7 @@ class LocalWhisperProviderSelectionTest(unittest.TestCase):
         service = VoiceService(api_key="", stt_provider="local_whisper")
         self.assertTrue(service.streaming_stt_enabled())
         self.assertEqual(service.stt_provider(), "local_whisper")
-        self.assertEqual(service.stt_model(), "large-v3")
+        self.assertEqual(service.stt_model(), "small")
 
     def test_missing_sidecar_url_falls_back_to_batch(self) -> None:
         service = VoiceService(
diff --git a/apps/api/app/test_voice_ws.py b/apps/api/app/test_voice_ws.py
index bd60c05..d3c9564 100644
--- a/apps/api/app/test_voice_ws.py
+++ b/apps/api/app/test_voice_ws.py
@@ -16,6 +16,7 @@ from .persona_repository import PersonaVoiceMap
 from .routes import voice as voice_routes
 from .services import multimodal_alliance_store
 from .services.voice import (
+    MELOTTS_TTS_MODEL,
     StreamingTranscriptEvent,
     TranscriptResult,
     TranscriptWord,
@@ -150,6 +151,27 @@ class _FakeRouteStreamingSession:
         self.aborted = True
 
 
+class VoiceHealthContractTest(unittest.IsolatedAsyncioTestCase):
+    async def test_melotts_health_reports_the_operated_model(self) -> None:
+        service = SimpleNamespace(
+            is_available=lambda: True,
+            stt_available=lambda: True,
+            tts_available=lambda: True,
+            tts_provider=lambda: "melotts",
+            stt_provider=lambda: "local_whisper",
+            stt_model=lambda: "small",
+            batch_stt_available=lambda: False,
+        )
+
+        with patch.object(voice_routes, "voice_service", service):
+            response = await voice_routes.voice_health()
+
+        body = json.loads(bytes(response.body))
+        self.assertEqual(body["status"], "ok")
+        self.assertEqual(body["tts_provider"], "melotts")
+        self.assertEqual(body["tts_model"], MELOTTS_TTS_MODEL)
+
+
 class VoiceWebSocketContractTest(unittest.IsolatedAsyncioTestCase):
     def _bind_result(self) -> tuple[str, VoicePreset, None, dict[str, object]]:
         return (
diff --git a/apps/api/requirements.txt b/apps/api/requirements.txt
index 293853e..d7aae2d 100644
--- a/apps/api/requirements.txt
+++ b/apps/api/requirements.txt
@@ -9,6 +9,8 @@ python-multipart==0.0.18
 httpx==0.28.1
 websockets==14.2
 sse-starlette==3.0.3
+# Windows G7 topology evidence pins and samples exact host-process provenance.
+psutil==6.1.1
 # P4(2026-07-13 회의): 자유 양식 엑셀 업로드 → 텍스트 변환 (personas/sources/upload)
 openpyxl==3.1.5
 
diff --git a/apps/web/e2e/admin.spec.ts b/apps/web/e2e/admin.spec.ts
index 527cd8a..52f260c 100644
--- a/apps/web/e2e/admin.spec.ts
+++ b/apps/web/e2e/admin.spec.ts
@@ -590,6 +590,12 @@ function isOnline(seconds: number) {
 }
 
 async function openAdminAndReadHealth(page: Page) {
+  const userSnapshots: AdminUsersResponse[] = [];
+  const collectUsersResponse = async (response: Response) => {
+    if (!isAdminUsersResponse(response) || !response.ok()) return;
+    userSnapshots.push((await response.json()) as AdminUsersResponse);
+  };
+  page.on("response", collectUsersResponse);
   const healthResponsePromise = page.waitForResponse(isAdminHealthResponse);
   const usageResponsePromise = page.waitForResponse(isAdminUsageResponse);
   const usersResponsePromise = page.waitForResponse(isAdminUsersResponse);
@@ -613,10 +619,36 @@ async function openAdminAndReadHealth(page: Page) {
 
   const health = (await healthResponse.json()) as AdminHealthResponse;
   const usage = (await usageResponse.json()) as AdminUsageResponse;
-  const users = (await usersResponse.json()) as AdminUsersResponse;
+  const initialUsers = (await usersResponse.json()) as AdminUsersResponse;
   const uptime = (await uptimeResponse.json()) as AdminUptimeResponse;
   const tickets = (await ticketsResponse.json()) as AdminTicketsResponse;
   expect(health.services.length).toBeGreaterThan(0);
+  if (userSnapshots.length === 0) userSnapshots.push(initialUsers);
+
+  let users = initialUsers;
+  await expect
+    .poll(
+      async () => {
+        const rendered = await page.locator(".vgops-kpi b").allTextContents();
+        const matchingSnapshot = userSnapshots.find((snapshot) => {
+          const activeSessions = snapshot.users.reduce(
+            (sum, user) => sum + Math.max(0, user.active_sessions),
+            0,
+          );
+          const onlineUsers = snapshot.users.filter((user) => isOnline(user.last_seen_at)).length;
+          return (
+            rendered[0] === countLabel(activeSessions) &&
+            rendered[1] === countLabel(onlineUsers) &&
+            rendered[2] === countLabel(snapshot.users.length)
+          );
+        });
+        if (matchingSnapshot) users = matchingSnapshot;
+        return Boolean(matchingSnapshot);
+      },
+      { message: "관리자 KPI가 실제 /admin/users 응답 중 하나를 반영해야 한다" },
+    )
+    .toBe(true);
+  page.off("response", collectUsersResponse);
   return { health, usage, users, uptime, tickets };
 }
 
diff --git a/apps/web/e2e/dev-dashboard.spec.ts b/apps/web/e2e/dev-dashboard.spec.ts
index 637404d..79a3b25 100644
--- a/apps/web/e2e/dev-dashboard.spec.ts
+++ b/apps/web/e2e/dev-dashboard.spec.ts
@@ -2,11 +2,12 @@ import http, { type Server } from "node:http";
 import { promises as fs } from "node:fs";
 import { AddressInfo } from "node:net";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { expect, test, type Page } from "@playwright/test";
 import { expectNoHorizontalOverflow } from "./support";
 
-const repoRoot = path.resolve(process.cwd(), "..", "..");
+const specDir = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(specDir, "..", "..", "..");
 const dashboardPath = path.join(repoRoot, "docs", "dev_dashboard.html");
 
 interface StaticServer {
@@ -144,8 +145,8 @@ async function readMetrics(page: Page): Promise<DashboardMetrics> {
 
 function expectDerivedMetrics(metrics: DashboardMetrics) {
   expect(metrics.total).toBeGreaterThan(0);
-  expect(metrics.done).toBe(33);
-  expect(metrics.doing).toBe(2);
+  expect(metrics.done).toBe(32);
+  expect(metrics.doing).toBe(3);
   expect(metrics.planned).toBe(0);
   expect(metrics.total).toBe(metrics.done + metrics.doing + metrics.planned);
   expect(metrics.ownerBoard).toBe(
@@ -336,6 +337,30 @@ test.describe("dev dashboard static command center", () => {
       await page.setViewportSize(viewport);
       await openDashboard(page, `http://localhost:${staticServer.port}/docs/dev_dashboard.html`);
       await expectNoHorizontalOverflow(page);
+
+      const pulseDetails = page.locator(".pulse-details");
+      await expect(pulseDetails).toHaveJSProperty("open", false);
+      await pulseDetails.locator("summary").click();
+      await expect(pulseDetails).toHaveJSProperty("open", true);
+      await expect(pulseDetails).toContainText("detached clean release와 exact Git commit/tree");
+      await pulseDetails.locator("summary").click();
+      await expect(pulseDetails).toHaveJSProperty("open", false);
+
+      if (viewport.width <= 760) {
+        const controlHeights = await page
+          .locator(".owner-pill, .fbtn, .tab-button, .dg-link, .pulse-details summary")
+          .evaluateAll((controls) =>
+            controls.map((control) => Math.ceil(control.getBoundingClientRect().height)),
+          );
+        expect(controlHeights.length).toBeGreaterThan(0);
+        expect(controlHeights.every((height) => height >= 44)).toBe(true);
+
+        const firstScreenPositions = await page.locator("#phase-rail, .kpis").evaluateAll((regions) =>
+          regions.map((region) => Math.floor(region.getBoundingClientRect().top)),
+        );
+        expect(firstScreenPositions).toHaveLength(2);
+        expect(firstScreenPositions.every((top) => top < viewport.height)).toBe(true);
+      }
     }
   });
 });
diff --git a/apps/web/e2e/self-directed-learning-loop.spec.ts b/apps/web/e2e/self-directed-learning-loop.spec.ts
index 62a7b9d..e9962b3 100644
--- a/apps/web/e2e/self-directed-learning-loop.spec.ts
+++ b/apps/web/e2e/self-directed-learning-loop.spec.ts
@@ -862,6 +862,60 @@ async function capture(page: Page, projectName: string, stage: string) {
 }
 
 test.describe("학습자 자기주도 전체 루프 — 실제 src UI / route fixture", () => {
+  test("3.5초 경계의 자기주도 경로 전환이 복구되면 부트 진단을 즉시 닫는다", async ({
+    page,
+  }) => {
+    await routeSelfDirectedUiFixture(page);
+    await page.goto("/learn");
+    await expect(
+      page.getByRole("heading", { name: "오늘 이어갈 회기를 먼저 봅니다." }),
+    ).toBeVisible();
+
+    // index.html의 첫 watchdog(3.5초)과 실제 자기주도 경로 전환을 겹친다.
+    // route가 잠깐 비어 보이는 동안에는 진단이 뜨되, React 콘텐츠 복구 후에는
+    // 두 번째 watchdog(8초)을 기다리지 않고 바로 사라져야 한다.
+    await page.evaluate(async () => {
+      const remaining = Math.max(0, 3_300 - performance.now());
+      await new Promise((resolve) => window.setTimeout(resolve, remaining));
+      const root = document.getElementById("root");
+      const action = document.querySelector<HTMLElement>(
+        "[data-learner-primary-action]",
+      );
+      if (!root || !action) {
+        throw new Error("self-directed route transition fixture unavailable");
+      }
+      root.style.visibility = "hidden";
+      action.click();
+    });
+
+    await expect(page).toHaveURL(/\/learn\/practice$/);
+    await expect(page.locator("#vignette-boot-diagnostic")).toBeVisible({
+      timeout: 1_200,
+    });
+
+    await page.evaluate(() => {
+      document.getElementById("root")?.style.removeProperty("visibility");
+    });
+    await expect(
+      page.getByRole("heading", { name: "연습할 내담자를 선택합니다." }),
+    ).toBeVisible();
+    await expect(page.locator("#vignette-boot-diagnostic")).toHaveCount(0, {
+      timeout: 1_000,
+    });
+  });
+
+  test("React 부트가 실제로 비어 있으면 진단을 유지한다", async ({ page }) => {
+    await page.route("**/src/main.tsx", (route) => route.abort("failed"));
+    await page.goto("/learn", { waitUntil: "domcontentloaded" });
+
+    const diagnostic = page.locator("#vignette-boot-diagnostic");
+    await expect(diagnostic).toBeVisible({ timeout: 4_500 });
+    await expect(diagnostic).toContainText("React 화면이 정상 콘텐츠를 표시하지 못해서");
+    await page.waitForTimeout(250);
+    await expect(diagnostic).toBeVisible();
+    await expect(page.locator("#root")).toBeEmpty();
+  });
+
   test("홈 추천과 목표 선택부터 회기·복기·처방 재연습 시작까지 한 흐름으로 보존한다", async ({
     page,
   }, testInfo) => {
diff --git a/apps/web/e2e/session-mvp.spec.ts b/apps/web/e2e/session-mvp.spec.ts
index d643719..84f4fc4 100644
--- a/apps/web/e2e/session-mvp.spec.ts
+++ b/apps/web/e2e/session-mvp.spec.ts
@@ -432,6 +432,24 @@ async function routeMvpApi(page: Page, options: RouteMvpOptions = {}) {
     });
   });
 
+  await page.route(
+    `**/api/sessions/${sessionId}/multimodal-alliance/consent`,
+    async (route) => {
+      const consentBody = route.request().postDataJSON() as Record<string, unknown>;
+      await route.fulfill({
+        status: 201,
+        contentType: "application/json",
+        body: JSON.stringify({
+          submission_id: consentBody.submission_id,
+          consent_snapshot_id: "00000000-0000-4000-8000-000000000777",
+          consent_status: "granted",
+          deletion_request_id: null,
+          idempotent_replay: false,
+        }),
+      });
+    },
+  );
+
   return {
     sessionStartRequests,
     liveCoachRequests,
@@ -444,6 +462,15 @@ async function routeMvpApi(page: Page, options: RouteMvpOptions = {}) {
   };
 }
 
+async function acceptVoiceInputConsent(page: Page) {
+  const consentDialog = page.getByRole("dialog", { name: "음성 입력을 사용하기 전에" });
+  await expect(consentDialog).toBeVisible();
+  await expect(consentDialog).toContainText("원음은 보존하지 않습니다");
+  await expect(consentDialog).toContainText("동의하지 않아도 텍스트로 계속할 수 있습니다");
+  await consentDialog.getByRole("button", { name: "동의하고 마이크 켜기" }).click();
+  await expect(consentDialog).toHaveCount(0);
+}
+
 async function installVoicePersistenceFailureFixture(page: Page, transcriptText: string) {
   await page.addInitScript((text) => {
     const fixture = {
@@ -1370,6 +1397,7 @@ test.describe("P1 MVP core loop", () => {
     const micButton = page.getByRole("button", { name: "마이크 켜기" });
     await expect(micButton).toBeEnabled();
     await micButton.click();
+    await acceptVoiceInputConsent(page);
     await page.getByRole("button", { name: "발화 보내기" }).click();
 
     const learnerBubble = page.locator(".sx-utt.is-learner").filter({ hasText: failedVoiceText });
@@ -1410,6 +1438,7 @@ test.describe("P1 MVP core loop", () => {
     await page.getByRole("button", { name: "이어가기" }).click();
 
     await page.getByRole("button", { name: "마이크 켜기" }).click();
+    await acceptVoiceInputConsent(page);
     await page.getByRole("button", { name: "발화 보내기" }).click();
 
     const transcriptLog = page.getByRole("log", { name: "실시간 상담 축어록" });
@@ -1494,6 +1523,7 @@ test.describe("P1 MVP core loop", () => {
     const micButton = page.getByRole("button", { name: "마이크 켜기" });
     await expect(micButton).toBeEnabled();
     await micButton.click();
+    await acceptVoiceInputConsent(page);
     await page.getByRole("button", { name: "발화 보내기" }).click();
 
     const learnerBubble = page.locator(".sx-utt.is-learner").filter({ hasText: crisisText });
diff --git a/apps/web/e2e/session-persistence.spec.ts b/apps/web/e2e/session-persistence.spec.ts
index cf37408..4268dc7 100644
--- a/apps/web/e2e/session-persistence.spec.ts
+++ b/apps/web/e2e/session-persistence.spec.ts
@@ -85,6 +85,8 @@ interface SessionDetailResponse {
   session_id: string;
   theory_mode: string;
   status: "active" | "ended";
+  started_at: string;
+  ended_at?: string | null;
   turns?: Array<{
     speaker: "learner" | "client";
     text: string;
@@ -548,6 +550,8 @@ async function openReviewTab(page: Page, label: "축어록" | "피드백" | "워
 }
 
 test.describe("session persistence", () => {
+  test.use({ timezoneId: "Asia/Seoul" });
+
   test("persists selected CBT theory mode from session UI into DB-backed detail @single-run", async ({
     page,
   }) => {
@@ -922,6 +926,21 @@ test.describe("session persistence", () => {
     await expect(page.locator(".sx-utt.is-learner").filter({ hasText: learnerText })).toBeVisible({
       timeout: 15_000,
     });
+    const reloadedDetailResponse = await page.request.get(`/api/sessions/${sessionId}`);
+    await expectResponseOk(reloadedDetailResponse);
+    const reloadedDetail = (await reloadedDetailResponse.json()) as SessionDetailResponse;
+    expect(reloadedDetail.status).toBe("active");
+    expect(reloadedDetail.ended_at).toBeNull();
+    expect(reloadedDetail.started_at).toMatch(/(?:Z|[+-]\d{2}:\d{2})$/);
+    const sessionAgeMs = Date.now() - Date.parse(reloadedDetail.started_at);
+    expect(Number.isFinite(sessionAgeMs)).toBe(true);
+    expect(sessionAgeMs).toBeGreaterThanOrEqual(-5_000);
+    expect(sessionAgeMs).toBeLessThan(10 * 60 * 1_000);
+    await expect(
+      page.locator(".sx-session-progress__grid > span").first().locator("b"),
+    ).toHaveText(/^0\d:[0-5]\d$/);
+    await expect(page.locator(".sx-timebar.is-over")).toHaveCount(0);
+    await expect(page.getByRole("dialog", { name: "회기 시간이 끝났어요" })).toHaveCount(0);
     const coachMark = page.locator(".sx-utt.is-learner .sx-utt__coach-mark");
     await expect(coachMark).toBeVisible({
       timeout: 15_000,
diff --git a/apps/web/e2e/session-review-fixture.ts b/apps/web/e2e/session-review-fixture.ts
index f9eda2b..e2920d9 100644
--- a/apps/web/e2e/session-review-fixture.ts
+++ b/apps/web/e2e/session-review-fixture.ts
@@ -246,6 +246,13 @@ export async function routeFilledSessionReview(
       body: JSON.stringify(filledReviewResponse(sessionId)),
     });
   });
+  await page.route(`**/api/sessions/${sessionId}/alliance-pulses`, async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify({ items: [] }),
+    });
+  });
 }
 
 export function prepostMeasuresResponse(
diff --git a/apps/web/e2e/session-review.spec.ts b/apps/web/e2e/session-review.spec.ts
index 6d5c1af..70d6a87 100644
--- a/apps/web/e2e/session-review.spec.ts
+++ b/apps/web/e2e/session-review.spec.ts
@@ -156,6 +156,7 @@ async function expectReviewRegionsReachable(page: Page) {
     .evaluate((el) => window.getComputedStyle(el).gridTemplateAreas);
   expect(transcriptAreas).toContain("transcript");
 
+  await page.locator(".sr-overview").scrollIntoViewIfNeeded();
   await expect(page.locator(".sr-overview")).toBeInViewport();
   await page.locator(".sr-card--transcript").scrollIntoViewIfNeeded();
   await expect(page.locator(".sr-card--transcript")).toBeInViewport();
@@ -546,9 +547,12 @@ test.describe("session review", () => {
         };
       }),
     );
-    expect(filterMetrics.every((item) => item.height <= 34 && item.whiteSpace === "nowrap")).toBe(
-      true,
-    );
+    expect(filterMetrics.every((item) => item.whiteSpace === "nowrap")).toBe(true);
+    if ((page.viewportSize()?.width ?? 0) <= 720) {
+      expect(filterMetrics.every((item) => item.height >= 44)).toBe(true);
+    } else {
+      expect(filterMetrics.every((item) => item.height <= 34)).toBe(true);
+    }
     await expectNoHorizontalOverflow(page);
   });
 
@@ -566,6 +570,7 @@ test.describe("session review", () => {
     expect(review.session_id).toBe(FILLED_REVIEW_SESSION_ID);
     expect(review.reviewReady).toBe(true);
     expect(review.turns).toHaveLength(6);
+    await expect(page.getByRole("button", { name: "다시 불러오기" })).toHaveCount(0);
 
     await expect(page).toHaveURL(new RegExp(`/learn/session/${FILLED_REVIEW_SESSION_ID}/review$`));
     await expect(page.getByText("관계 신호가 안정적으로 회복된 회기")).toBeVisible();
diff --git a/apps/web/index.html b/apps/web/index.html
index 6d465de..3800010 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -74,6 +74,8 @@
         var errors = [];
         var loadedAt = Date.now();
         var sentDiagnostics = {};
+        var healthyCheckTimer = null;
+        var healthyObserver = null;
         function short(value) {
           return String(value || "").slice(0, 900);
         }
@@ -116,14 +118,68 @@
             style.opacity !== "0"
           );
         }
-        function visibleCount() {
+        function visibleCount(scope) {
+          var root = scope || document;
           var nodes = Array.prototype.slice.call(
-            document.querySelectorAll(
+            root.querySelectorAll(
               "main,header,h1,h2,p,a,button,input,select,article,section,.vg-shell,.vg-route-error,.vgops-head,.vgops-diagnostic,.lg-root",
             ),
           );
           return nodes.filter(isVisiblyRendered).length;
         }
+        function appHealth() {
+          var root = document.getElementById("root");
+          var path = window.location.pathname;
+          var isAdmin = path === "/admin" || path.indexOf("/admin/") === 0;
+          var text = (root && root.innerText ? root.innerText : "").trim();
+          var visible = root ? visibleCount(root) : 0;
+          var adminContent = root
+            ? root.querySelector(
+                "[data-vignette-admin-root],[data-vignette-admin-diagnostic],[data-testid='admin-ai-page']",
+              )
+            : null;
+          var hasAdminContent = !isAdmin || isVisiblyRendered(adminContent);
+          return {
+            healthy: Boolean(
+              root &&
+                root.childElementCount > 0 &&
+                text.length > 24 &&
+                visible > 0 &&
+                hasAdminContent,
+            ),
+            visible: visible,
+          };
+        }
+        function dismissDiagnosticIfHealthy() {
+          if (!appHealth().healthy) return false;
+          var panel = document.getElementById("vignette-boot-diagnostic");
+          if (panel) panel.remove();
+          return true;
+        }
+        function scheduleHealthyCheck() {
+          if (healthyCheckTimer !== null) window.clearTimeout(healthyCheckTimer);
+          healthyCheckTimer = window.setTimeout(function () {
+            healthyCheckTimer = null;
+            dismissDiagnosticIfHealthy();
+          }, 60);
+        }
+        function observeAppHealth() {
+          if (healthyObserver || !window.MutationObserver) return;
+          var root = document.getElementById("root");
+          if (!root) {
+            window.setTimeout(observeAppHealth, 100);
+            return;
+          }
+          healthyObserver = new MutationObserver(scheduleHealthyCheck);
+          healthyObserver.observe(root, {
+            attributes: true,
+            attributeFilter: ["aria-hidden", "class", "hidden", "style"],
+            characterData: true,
+            childList: true,
+            subtree: true,
+          });
+          scheduleHealthyCheck();
+        }
         function diagnosticApiBase() {
           var host = window.location.hostname;
           if (host === "vignette.chanpaca.net" || host.endsWith(".pages.dev")) {
@@ -183,19 +239,16 @@
         }
         function render(reason) {
           var path = window.location.pathname;
-          var isAdmin = path === "/admin" || path.indexOf("/admin/") === 0;
           var text = (document.body && document.body.innerText ? document.body.innerText : "").trim();
-          var visible = visibleCount();
-          var adminContent = document.querySelector(
-            "[data-vignette-admin-root],[data-vignette-admin-diagnostic],[data-testid='admin-ai-page']",
-          );
-          var hasAdminContent = !isAdmin || isVisiblyRendered(adminContent);
-          if (reason === "watchdog" && text.length > 24 && visible > 0 && hasAdminContent) {
-            var old = document.getElementById("vignette-boot-diagnostic");
-            if (old) old.remove();
+          var health = appHealth();
+          if (health.healthy && reason !== "manual") {
+            if (reason !== "watchdog") {
+              sendDiagnostic(reason, text.length, health.visible);
+            }
+            dismissDiagnosticIfHealthy();
             return;
           }
-          sendDiagnostic(reason, text.length, visible);
+          sendDiagnostic(reason, text.length, health.visible);
 
           var panel = document.getElementById("vignette-boot-diagnostic");
           if (!panel) {
@@ -229,7 +282,7 @@
               text.length +
               "</dd>",
             "<dt style=\"padding:7px 9px;background:rgba(0,0,0,.04);font-weight:700\">visibleNodes</dt><dd style=\"margin:0;padding:7px 9px;overflow-wrap:anywhere\">" +
-              visible +
+              health.visible +
               "</dd>",
             "<dt style=\"padding:7px 9px;background:rgba(0,0,0,.04);font-weight:700\">elapsed</dt><dd style=\"margin:0;padding:7px 9px;overflow-wrap:anywhere\">" +
               (Date.now() - loadedAt) +
@@ -260,6 +313,7 @@
             render("manual");
           },
         };
+        observeAppHealth();
         window.setTimeout(function () {
           render("watchdog");
         }, 3500);
diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index 945786a..0f80267 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -1,13 +1,17 @@
-# Vignette G0~G8 완료 핸드오프
+# Vignette G0~G8 완료 추진 핸드오프
 
-> Updated: 2026-08-07 KST (G8 실제 rollback 종료 반영)
+> Updated: 2026-08-09 KST (다른 에이전트 실행용 최종 인계 · G7 외부-proof P0 코드 완료 · current-source fixture 분할 GREEN/clean HEAD 재실행)
 > Workspace: `D:\workspace\vignette`
-> 이 문서는 다음 에이전트가 **G0~G8 아홉 목표 중 마지막으로 남은 G7 외부 게이트를 닫기 위한** 실행 기준이다.
+> 이 문서는 다음 에이전트가 **G0~G8 아홉 목표 중 남은 G7 외부 게이트와 G8 NAS-origin 재검증을 닫기 위한** 실행 기준이다.
 
 ## 0. 현재 상태 한 줄 요약
 
-**G0~G6·G8은 internal DONE + 실제 runtime 증거로 종료됐다. 남은 것은 G7 외부 4-artifact 게이트 하나이며,
-이건 코드로 풀 수 없고 사용자가 제공해야 하는 운영 자원·동의가 있어야 진행된다.**
+**G0~G6의 내부 구현·증거는 종료됐다. 단, 최종 clean source 전체 회귀는 다시 실행해야 한다. G8 실제 rollback
+receipt는 완료됐지만 current source clean-head 승격은 아직 0회다.
+두 execute는 모두 NAS mutation 전에 안전하게 중단됐다. naive `started_at`의 9시간 오차 P0는 UTC/KST 계약과
+실DB 브라우저 회귀로 수정됐고, 이제 새 clean commit 결속과 NAS-origin 전체 E2E가 남았다. G7 공개 런처의
+local sidecar lifecycle·provider/model readiness·Uvicorn queue, fresh PID/source provenance, 3,120초 runner와
+3,000초 공통 시간창·canonical exit 계약은 소스에서 완료됐지만, current source 공개 배포와 외부 4-artifact 게이트는 남아 있다.**
 
 | Goal | 판정 | 완료 증거 |
 |---|---|---|
@@ -18,28 +22,89 @@
 | G4 Deliberate Practice | DONE | completed-session observer, actual API/DB attempts, teacher correction, returned-practice browser 폐루프 |
 | G5 Calibration & Transfer | DONE | actual transfer execution, independent/model-run/instrument/evidence provenance, DB/browser idempotency |
 | G6 Supervision & Research | DONE | safety event metadata-only projection, safety priority 1 > deterioration 2, raw detail 0 |
-| G7 Multimodal Alliance | **internal DONE · external GATE** | consent/withdrawal, synthetic soak 59/59, public unauth WSS 1008, focused 119 PASS |
-| G8 Continuous Improvement | **DONE** | 격리 NAS 실제 image rollback 2회 + executed receipt 2건 (아래 §3) |
+| G7 Multimodal Alliance | **internal DONE · external GATE** | consent/withdrawal, synthetic soak 59/59, G7 runner/checker/topology 86/86, launcher/sidecar 80/80, API voice 71/71 |
+| G8 Continuous Improvement | **receipt DONE · runtime REVALIDATION** | 실제 image rollback 2회 + executed receipt 2건. timestamp 수정 실DB GREEN, 새 clean commit·NAS-origin E2E 미완료 |
 
-대시보드 status count는 **33 done / 2 doing / 0 planned**다.
+대시보드 status count는 **32 done / 3 doing / 0 planned**다.
 
-### 완료 조건 판정 (2026-08-08 재검증)
+Git 기준선은 branch `master`, HEAD `94c681d450d2f3b4df55c036e333cd817db3f7fb`이고 `origin/master`보다 2 commit
+앞서 있다. 공유 worktree에는
+문서/대시보드/G7·G8 런북, 완결된 clean-head 릴리스 에이전트·테스트, UTC/KST session timestamp 수정과
+browser 회귀가 tracked dirty로 남아 있다. Git 작업은 stage/commit/push하지 않았다.
+
+### 이 문서가 인계된 정확한 중단점
+
+- 사용자가 **현재 구현을 잠시 멈추고 다른 에이전트로 넘길 핸드오프를 만들라**고 요청했다. 핸드오프 정리 중
+  public/NAS/DB/마이크/프로세스의 수동 mutation은 0회다. 5분 Scheduled Task는 한 번씩 자동 실행됐으나 아래
+  source-pin gate에서 안전하게 exit 1로 중단됐다.
+- active goal은 계속 `active`다. 목표는 “문서 작성”이 아니라 **G0~G8 아홉 목표를 실제 runtime과 E2E로
+  모두 닫는 것**이다. G7 canonical checker exit 0과 G8 current clean source의 NAS-origin 0-failure가 없으면
+  `goal complete`를 호출하지 않는다.
+- 마지막 완료 작업은 G7 runner/checker/topology·fresh public launcher provenance P0, session timestamp UTC/KST 계약,
+  API full 921/921, gateway 58/58, Web API types·typecheck·build, 자기주도 route fixture desktop/mobile 6/6이다.
+  fixture desktop/mobile은 마지막 단일
+  120/120 뒤 dashboard spec/HTML이 다시 바뀌었고 그 변경의 dashboard 10/10을 별도로 확인했으므로,
+  **현재 트리는 불변 110 + 최신 dashboard 10의 분할 GREEN**이다. 새 clean HEAD에서 exact 120을 다시 실행한다.
+- G7 Windows topology mode, 3,000초 공통 시간창, canonical checker-bound exit와 공개 런처의 local
+  Whisper/MeloTTS lifecycle·exact readiness·Uvicorn queue·fresh API/cloudflared provenance 계약은 코드와 회귀가
+  끝났지만 public launcher 실행과 capture는 수행하지 않았다.
+  현재 public API가 Git metadata가 없는 냉동 release 디렉터리에서 실행되므로 provenance gate가 의도적으로
+  닫혀 있다. 이 검증을 약화해서 통과시키면 안 된다.
+- **public task source-pin P0:** watchdog·로그온 boot는 이제 detached clean release만 허용하고 Git
+  commit/tree와 watchdog|boot/start script SHA를 health·Docker·process mutation 전에 검증한다. hidden VBS도
+  shared source를 직접 실행하지 않고 구조적으로 pin된 task만 trigger한다. 회귀는 provenance 11개를 포함한
+  watchdog/start/cutover combined 22/22, PowerShell 5.1 parser·WSH syntax PASS다. 그러나 **실제 두 Scheduled Task action은
+  아직 shared worktree를 가리키며 pin 인자가 없다.** 5분 watchdog은 pin 부재로 반복 실행마다
+  `LastTaskResult=1`이고, 새 필수 pin 인자 부재 때문에 운영 프로세스를 건드리기 전에 의도대로 fail-closed했다.
+  18:02:55 KST에는 Docker Desktop UI가 active DB container에 직접 stop을 보내 public `db=false`가 재발했다.
+  같은 container ID와 recovered named volume만 18:05 KST 재시작했고, 공개 local/public health는 다시
+  `status=ok, db=true, engine=true`다. clean commit 뒤 두 task를 동일한 detached stable
+  release root로 재등록하고 action pin·watchdog result 0·로그온/reboot smoke를 확인하기 전에는 public runtime
+  자동복구를 DONE으로 부르지 않는다.
+- 다음 에이전트의 첫 mutation은 **사용자 승인 아래 새 clean commit 생성**이어야 한다. 그 clean source만 G8 NAS
+  preview 또는 G7 public runtime의 배포 입력으로 쓰고, 두 환경을 동시에 변경하지 말며 mutation owner는 한 명만 둔다.
+
+### 완료 조건 판정 (2026-08-09 재검증)
 
 원래 active goal의 완료 선언 조건 네 가지를 실행으로 대조한 결과다.
 
 | # | 조건 | 판정 | 근거 |
 |---|---|---|---|
-| 1 | G0~G8 각각의 코드 계약과 실제 runtime 증거 | **부분 충족** | G0~G6·G8은 충족. **G7만 외부 GATE로 열려 있다** |
+| 1 | G0~G8 각각의 코드 계약과 실제 runtime 증거 | **부분 충족** | G0~G6 충족. G8 receipt는 충족했지만 NAS-origin 회기 재검증이 남았고 G7 외부 GATE가 열려 있다 |
 | 2 | 학생 홈→회기→리뷰→처방→재연습→전이 폐루프가 실제 API/DB/browser 통과 | **충족** | 일회용 클론에서 `returned-practice-db-closed-loop` desktop 2/2 + mobile 2/2, route mock 0 |
-| 3 | current source 증거와 대시보드·TODO·backlog 일치 | **충족** | SSOT checker FAIL 0, unit 5/5, dashboard E2E 10/10, count 33/2/0이 카드와 일치 |
+| 3 | current source 증거와 대시보드·TODO·backlog 일치 | **충족** | SSOT checker FAIL 0, unit 5/5, dashboard E2E 10/10, count 32/3/0이 카드와 일치 |
 | 4 | G7을 가짜·합성 증거로 DONE 처리하지 않음 | **충족** | `check-g7-external-proof.py` exit 1 유지, G7 카드는 `GATE` |
 
-재검증 수치: API **914 passed**, gateway **58**, executor **28**, probe **11**, helper launcher **37**,
-release agent **21**, MeloTTS 사이드카 **16**, local whisper 사이드카 **37**, SSOT FAIL **0**,
+재검증 수치: API **921 passed**, gateway **58**, executor **28**, probe **11**, helper launcher **37**,
+release agent **30**, G7 runner/checker/topology 묶음 **86**, G7 public launcher/sidecar **80**, G7 통합 **166**,
+API voice 통합 **71**,
+MeloTTS 사이드카 **16**, local whisper 사이드카 **38**,
+SSOT FAIL **0**,
 dashboard E2E **10/10**, web api-types·typecheck·build 통과, ruff clean.
 
-**따라서 `update_goal complete`를 호출하지 않는다.** 조건 1이 G7 때문에 미충족이고, 조건 4가 그것을
-합성 증거로 메우는 것을 금지한다. G8 자체는 종료됐다(§3).
+current-source fixture 묶음은 16:49 KST 단일 실행에서 **120/120 PASS(92.0s)**했다. dev dashboard file URL은 실행 cwd가
+아니라 spec의 `import.meta.url`로 repo root를 찾으며, session-review fixture는 alliance pulse까지 소유한다. 관리자
+live health 테스트는 React StrictMode 중복 조회의 첫 응답을 고정하지 않고 화면이 실제 반영한 성공
+`/admin/users` 스냅샷과 KPI를 결속한다. 그 뒤 dev-dashboard spec/HTML이 변경됐고 최신 dashboard 10/10만 따로
+재검증됐다. 따라서 current tree의 정직한 판정은 **110 불변 + 10 최신 분할 GREEN**이며, 새 clean commit에서
+같은 120건을 한 번 재실행해 archive/source 결속 뒤의 결과를 고정한다.
+
+**따라서 `update_goal complete`를 호출하지 않는다.** 조건 1이 G7과 G8 NAS-origin 재검증 때문에 미충족이고,
+조건 4가 G7을 합성 증거로 메우는 것을 금지한다. G8 receipt 자체는 종료됐다(§3).
+
+### G0~G8 목표별 인수 기준
+
+| Goal | 원 계획의 종료 조건 | 현재 인정 가능한 증거 | 다음 에이전트가 최종 종료 전에 할 일 |
+|---|---|---|---|
+| G0 | 100% provenance, evaluator/client 누수 0, Python/TS/DB schema conformance, 기존 회기 무회귀 | current producer census 29/29, 위반 0, migrations 14~16 2회 멱등 | current HEAD 전체 backend/schema 회귀와 최종 census를 다시 실행 |
+| G1 | goal/task/bond 독립 저장, 축별 UI, gold 근거 span, 평가 실패 fail-closed | prediction 24/24 ready, 방향 9/9, error 0, recall 94.4%, precision 73.9%, pre/mid/post UI | current HEAD의 alliance desktop/mobile·DB-backed session 경로 재실행 |
+| G2 | 5회기 연속성, 조기 경보 recall, false alert/uncertainty, synthetic 비임상 경계 | accuracy/recall 1.0, false alert 0, 실제 DB 10 sessions/30 measurements | current HEAD outcome trajectory API/UI 회귀 재실행 |
+| G3 | rupture 유형 benchmark, missed/partial/resolved E2E, gaming/암기 방지 | macro-F1/status 1.0, gaming 0, 실제 DB/API missed→partial→resolved | text/SSE 회기 및 rupture UI desktop/mobile 재실행 |
+| G4 | 모든 코칭 카드의 실행 재연습, 전후 근거 저장, unseen 전이 전 mastery 금지 | 실제 API/DB attempt·observer·teacher correction, browser route mock 0 | disposable DB에서 returned-practice desktop/mobile 4/4와 멱등 재확인 |
+| G5 | 자기평가 잠금, calibration 감소, unseen transfer 유지, subgroup drift | actual transfer execution과 independent/model-run/instrument/evidence provenance | G4와 같은 disposable DB에서 actual POST·read reload·1→1 멱등 재확인 |
+| G6 | 3-click queue, 원장 drilldown, 버전 재현, 역할/RLS/audit | safety metadata-only, safety priority 1 > deterioration 2, raw detail 0 | current HEAD producer/store/API와 supervisor UI 회귀 재실행 |
+| G7 | 시간 정렬, **물리 마이크+공개 WSS 장시간 E2E**, text-only 대비 음성 이득, 동의/삭제 정책 | 내부 계약·synthetic soak만 완료. canonical checker는 의도적으로 exit 1 | current 공개 배포→인증 WSS→명시 동의 mic 50분→동시 runtime/topology→독립 human pack→checker exit 0 |
+| G8 | source→draft→red-team→benchmark→catalog 재현, 누수/PII/무근거 0, 자동 calibration+rollback, incident→test/backlog 환류 | agentic worker·human gate·실제 rollback/restore receipt 2건, timestamp focused 실DB/browser GREEN | 사용자 승인 아래 새 clean commit→NAS 배포→**실제 NAS origin** 전체 회기 E2E GREEN→SSOT 동기화 |
 
 ## 1. 작업 시작 전 반드시 읽을 파일
 
@@ -61,14 +126,29 @@ dashboard E2E **10/10**, web api-types·typecheck·build 통과, ruff clean.
 - Windows 11 + PowerShell 환경이다. 실행 전 OS·셸·도구 경로를 다시 확인한다.
 - 명령은 PowerShell 5.1 호환 문법을 기본으로 작성한다. NAS 원격 스크립트는 **UTF-8 base64 전달 방식**을 쓴다.
   (`$()`가 PowerShell에서 먼저 확장되는 것을 막는다.)
-- worktree는 큰 규모로 dirty하다. `git reset --hard`, `git checkout --`, 대규모 자동 포맷, 임의 삭제 금지.
+- 이 핸드오프 작성 시 branch/HEAD는 `master` / `94c681d450d2f3b4df55c036e333cd817db3f7fb`이고 include 후보는
+  52개다: UTC/KST timestamp, G7 voice/topology/public launcher, pinned `psutil`, G8 clean-head controller, public task source pin,
+  학생 boot recovery, current fixture 안정화, dashboard/TODO/backlog/HANDOFF·런북 동기화다. 이 묶음들은 아직
+  commit에 들어 있지 않다.
+- clean-head 구현은 unit 30/30, G7 runner/checker/topology는 86/86, G7 public launcher/sidecar는 80/80,
+  public task source pin은 provenance 11개를 포함한 combined 22/22, timestamp·voice 계약을 포함한 API는
+  921/921와 KST 실DB browser 1/1, current fixture는 110 불변 + 최신 dashboard 10 분할 GREEN,
+  SSOT는 FAIL 0와 dashboard E2E 10/10을 통과했다. 다음 에이전트는 최초 diff review 뒤 동일한 focused gate를
+  다시 실행하고, 서로 다른 lane의 파일을
+  누락한 채 clean commit을 만들지 않는다.
+- 기존·watchdog 생성 엔진 로그 4개와 `apps/web/test-results/`의 PNG 2개는 commit에서 제외하고 보존한다. 신규
+  `apps/api/app/test_session_read_model.py`와
+  `docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json`은 이번 목표 산출물이므로 clean source에
+  포함해야 한다.
+  시작 즉시 `git status --short`로 다시 확인하고 `git reset --hard`, `git checkout --`, 대규모 자동 포맷, 임의 삭제는 금지한다.
 - Git commit/stage/push는 사용자가 요청하기 전에는 하지 않는다.
 - 공개 복구 DB, 원본 volume, pre-recovery container, dump, NAS named volume, 이전 API/Web 이미지를 삭제하지 않는다.
-- **로컬 포트 8001(공개 API) · 5173(공개 Web) · 55432(공개 DB) · 9099/9100(엔진)은 공개 런타임이다.**
-  `scripts/dev-up.ps1`은 8000/5173 리스너를 정리하므로 공개 런타임이 떠 있는 동안 실행하지 않는다.
+- **로컬 포트 8001(공개 API origin) · 55432(공개 DB) · 9099/9100(엔진)은 공개 런타임이다.**
+  공개 Web은 Cloudflare Pages이고 5174는 `vnet.18ka.net`용 로컬 preview다. `scripts/dev-up.ps1`은 런타임
+  리스너를 정리할 수 있으므로 공개 런타임이 떠 있는 동안 실행하지 않는다.
 - 비밀값, 이메일, cookie, 사용자 UUID가 포함된 raw response, `.env` 내용은 로그·증거·채팅에 출력하지 않는다.
 
-## 3. G8 — 종료됨 (2026-08-07 21:04~21:12 KST)
+## 3. G8 receipt — 종료됨 · NAS-origin runtime 재검증은 열림
 
 ### Gate6 계약 정정 (성립 불가능했던 이전 계약을 코드로 교체)
 
@@ -104,31 +184,55 @@ dashboard E2E **10/10**, web api-types·typecheck·build 통과, ruff clean.
 
 ## 4. 공개 서비스 복구 상태 — 이미 완료, 다시 망가뜨리지 말 것
 
-공개 계정·회기 DB 복구는 2026-08-07 18:26 KST에 완료됐다.
+공개 계정·회기 DB 복구는 2026-08-07 18:26 KST에 완료됐다. 2026-08-09 14:03 KST에는 Docker Desktop이
+중단돼 DB listener가 사라지면서 public health가 일시적으로 `db=false`가 됐고, 18:02:55 KST에는 Docker Desktop
+UI가 active DB container에 직접 stop을 보내 같은 증상이 재발했다. 두 번 모두 보존된 동일 컨테이너·볼륨만
+재기동해 복구했다. 새 컨테이너·볼륨 생성이나 데이터 복원 덮어쓰기는 없었다.
 
 - Public Web `https://vignette.chanpaca.net` · Public API `https://api-vignette.chanpaca.net` (origin `127.0.0.1:8001`)
 - active DB container `vignette-dev-db`, volume `vignette_recovered_prod_20260807`, restart `unless-stopped`
-- 복구 집계: users 84, sessions 30, turns 705, Google users 16, orphan sessions 0
+- cutover 기준 복구 집계: users 84, sessions 30, turns 705, Google users 16, orphan sessions 0
+- 2026-08-09 18:05 KST 재기동 후 owner read-only 집계: users 356, sessions 193, turns 726, Google users 16,
+  Google-owned sessions 31. 조회는 `BEGIN READ ONLY` 뒤 `ROLLBACK`했고 PII를 출력하지 않았다.
 - health `environment=prod`, `db=true`, `engine=true`, `engine_mode=claude_cli`, dev-login disabled, unauth `/auth/me` 401
-- 공개 OpenAPI 119 paths · watchdog `VignettePublicRuntimeWatchdog` 5분 주기
+- **2026-08-09 18:05 KST recovery snapshot:** local/public health는 `status=ok, db=true, engine=true`, Google OAuth
+  start는 302→`accounts.google.com`, 공개 OpenAPI는 119 paths다. `/voice/health`는 아직 OpenAI STT/TTS이고
+  local Whisper 9882·MeloTTS 9883 listener는 0이다.
+- DB 컨테이너는 `vignette_recovered_prod_20260807` named volume과 `unless-stopped`를 유지하고 local/public
+  health는 `status=ok, db=true, engine=true`다. 다만 watchdog·로그온 task action은 아직 shared worktree이며
+  stable root/commit/tree pin 인자가 없다. 새 source-pin 코드가 5분 watchdog을 mutation 전에 차단해 반복 실행이
+  `LastTaskResult=1`이다. clean commit의 detached release root로 두 task를 재등록하기 전까지 자동복구가
+  의도적으로 비활성인 상태다.
 
 보안상 과거 `auth_session`은 복원하지 않았다. 사용자는 Google 재로그인이 필요하다.
 
-보존물: pre-recovery container `vignette-dev-db-pre-recovery-20260807-182642`,
-pre-cutover dump `…20260807-091057Z.dump` SHA256 `6b84d5c8…af1f`,
-recovered dump `…20260807-092630Z.dump` SHA256 `d7bcc396…68ed`,
-post-cutover dump `…20260807-095511Z.dump` SHA256 `660695c8…65b88`.
+보존물: pre-recovery container `vignette-dev-db-pre-recovery-20260807-182642`과 원본/recovery Docker volumes.
+과거 증거에는 pre-cutover dump `…20260807-091057Z.dump` SHA256 `6b84d5c8…af1f`, recovered dump
+`…20260807-092630Z.dump` SHA256 `d7bcc396…68ed`, post-cutover dump `…20260807-095511Z.dump` SHA256
+`660695c8…65b88`이 기록돼 있으나, **인계 시점 로컬에는 `D:\workspace\vignette-backups` 디렉터리가 없고
+`D:\workspace\vignette-recovery`에도 이 dump들이 보이지 않는다.** 삭제로 단정하지 말고 off-host/NAS/다른 경로를
+확인하기 전 restore·cleanup을 금지한다. NAS의 pre-proof/pre-clean-head dump는 §5 기준으로 실제 존재와 hash를
+재확인했다.
 
 공개 DB에는 current dirty source를 배포하지 않는다.
 
-## 5. current source NAS 배포 — 완료
+## 5. NAS 배포 기준선 — 현재 HEAD가 아니라 2026-08-07 릴리스
 
-- URL `http://100.116.83.60:8088` · project `vignette-preview-20260807` · remote root `/volume1/docker/vignette-preview-20260807`
-- active release SHA `6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611`
-- API `sha256:52e0e816…8b2d` / Web `sha256:6fdbb646…f215` (previous: `79ec731f…0450` / `c530213f…62f28`)
+- **2026-08-09 17:07 KST read-only snapshot:** URL `http://100.116.83.60:8088` · project
+  `vignette-preview-20260807` · remote root `/volume1/docker/vignette-preview-20260807` · active release SHA
+  `6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611`.
+- API `sha256:52e0e816…8b2d` / Web `sha256:6fdbb646…f215` exact image가 실행 중이고 previous
+  `79ec731f…0450` / `c530213f…62f28`도 보존돼 있다. Compose `api/web/db/proxy` 4개는 모두 running,
+  restart policy는 `unless-stopped`다.
 - DB volume `vignette-preview-20260807_pgdata` · pre-proof dump `vignette-preview-g8-preproof-20260807T110610Z.dump`
-  SHA256 `92ed4736…1570f`
-- candidate browser E2E 108/108(634.578s), postdeploy SSE→DB review PASS
+  SHA256 `92ed4736…1570f`, 960,970 bytes · pre-clean-head dump
+  `vignette-preview-pre-clean-head-20260809T051611Z.dump` SHA256 `726982…5d41c`, 1,015,222 bytes.
+- health 3/3(`db=true`, `engine=true`), auth 401, OpenAPI 126 + G1~G8 route, root/JS/CSS 200이다.
+- helper container 0, NAS listener 8018/18149 0, Windows tunnel listener 18018 0이다.
+- **P1 권한 관측:** remote release root와 Compose 파일이 mode `0777`이다. 다음 execute 전에 owner/mode를
+  최소권한으로 좁히고 release agent preflight가 이를 fail-closed로 검증해야 한다. 현재 상태를 안전한 배포 신뢰
+  경계로 간주하지 않는다.
+- localhost candidate browser E2E 108/108(634.578s), postdeploy SSE→DB review PASS
 - **G8 rollback/restore 이후 재검증:** 실제 브라우저 SSE→DB review 재실행 PASS(35.0s)
 
 배포 중 첫 108 gate가 103/5로 fail-closed된 이력(G5 fixture drift, StrictMode retry fixture, `shell.css` manifest 누락)은
@@ -151,29 +255,235 @@ post-cutover dump `…20260807-095511Z.dump` SHA256 `660695c8…65b88`.
 - 교훈: candidate gate를 localhost에서만 돌리면 secure-context 전용 API 결함을 못 잡는다. 배포 대상과
   같은 scheme/host 형태에서 최소 한 번은 회기 리뷰 라우트를 열어봐야 한다.
 
-## 6. **다음 에이전트의 유일한 남은 목표 — G7 외부 종료 Gate**
+## 6. 다음 실행 순서 — G8 runtime 재검증 후 G7 외부 종료
 
-G7 내부 구현은 완료됐고 `scripts/check-g7-external-proof.py`는 현재 의도적으로 exit 1이다.
+### 6.1 G8: clean-head 릴리스 경로부터 완성
+
+`scripts/run-outcome-os-release-agent.py`의 명시적 clean-head 경로는 구현됐다. 기존 patch mode를 기본값으로
+보존하며, tracked-clean source worktree의 exact HEAD/tree/archive만 candidate로 사용한다. 수동 복사나 NAS 직접
+빌드는 계속 금지한다.
+
+구현된 **`--source-mode clean-head`** 계약은 다음과 같다.
+
+1. tracked dirty가 있으면 fail-closed. untracked 로그·테스트 결과는 archive에서 제외한다.
+2. exact Git HEAD, tree, `git archive` SHA를 증거에 기록한다.
+3. 같은 HEAD의 archive를 두 번 만들어 SHA가 동일한지 검증한다.
+4. candidate는 그 archive만 풀어 만들고 patch/manifest를 암묵 적용하지 않는다.
+5. 기존 preflight·API full·Web type/build·release E2E·DB snapshot·rollback 절차는 그대로 유지한다.
+6. Vite source 전용 `e2e/insecure-context-uuid.spec.ts`는 별도 localhost gate(5198)로 6/6 실행하고,
+   production candidate/NAS-origin은 실제 배포 번들에서 동작하는 11개 회기 스펙만 실행한다.
+7. unit/fake runner가 tracked dirty, archive SHA drift, evidence binding, patch-mode 무회귀를 검증해야 한다.
+
+검증: release-agent unit 30/30, source-only UUID gate 6/6, Ruff, py_compile, `git diff --check` PASS. 공유 worktree에는
+인계 문서와 controller 변경이 있으므로 이 경로 자체가 의도대로 tracked-dirty를 차단한다. 실제 배포는 새 commit을
+가리키는 별도 detached clean worktree를 만들고 `--source-repo-root <clean-worktree>`로 지정한 뒤
+dry-run→execute 순서로 수행한다.
+
+#### clean commit preflight — include 52 / exclude 6
+
+2026-08-09 최종 경로 목록 SHA-256은 ordinal 정렬된 UTF-8 LF 경로를 줄바꿈으로 연결하고 마지막 개행 없이 계산해
+include `4d94694ccf9def6945272c61f673cac0eaa9fb59f4f9b6c165d661d819f891a1`, exclude
+`1ff8c26732772df6b5857bf84de01a53d7da9c3b7d52df08938e77f3a527f022`다. 아래 include 52개만
+사용자 승인 후 **명시적으로** stage한다. 그 직전 `git status --porcelain=v1 -uall`로 목록·해시를 다시 계산하고,
+새 경로가 하나라도 있으면 멈춘다. `git add -A`는 금지한다.
+
+```text
+apps/api/app/config.py
+apps/api/app/routes/voice.py
+apps/api/app/services/session_metrics.py
+apps/api/app/services/voice.py
+apps/api/app/session_read_model.py
+apps/api/app/test_session_read_model.py
+apps/api/app/test_voice_service.py
+apps/api/app/test_voice_ws.py
+apps/api/requirements.txt
+apps/web/e2e/admin.spec.ts
+apps/web/e2e/dev-dashboard.spec.ts
+apps/web/e2e/self-directed-learning-loop.spec.ts
+apps/web/e2e/session-mvp.spec.ts
+apps/web/e2e/session-persistence.spec.ts
+apps/web/e2e/session-review-fixture.ts
+apps/web/e2e/session-review.spec.ts
+apps/web/index.html
+docs/HANDOFF.md
+docs/TODO.md
+docs/decisions/local-voice-stack.md
+docs/dev_dashboard.html
+docs/guides/local-development.md
+docs/guides/testing.md
+docs/ops/backlog-2026-06-26.md
+docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json
+docs/ops/nas-preview-g8-rollback-proof-runbook.md
+docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md
+docs/ops/public-runtime-watchdog.md
+scripts/boot-public-runtime.ps1
+scripts/capture-g7-topology-evidence.py
+scripts/check-dev-dashboard-ssot.py
+scripts/check-g7-external-proof.py
+scripts/install-public-runtime-task.ps1
+scripts/local-whisper-stt-server.py
+scripts/melotts-server.py
+scripts/probe-public-voice-sidecars.py
+scripts/register-boot-task.ps1
+scripts/run-g7-external-proof-window.py
+scripts/run-outcome-os-release-agent.py
+scripts/start-local-whisper-stt.ps1
+scripts/start-public-runtime.ps1
+scripts/test_g7_external_proof.py
+scripts/test_g7_topology_evidence.py
+scripts/test_local_whisper_stt_server.py
+scripts/test_melotts_server.py
+scripts/test_outcome_os_release_agent.py
+scripts/test_public_runtime_watchdog_provenance.py
+scripts/test_public_voice_sidecar_probe.py
+scripts/test_run_g7_external_proof_window.py
+scripts/test_start_public_runtime_contract.py
+scripts/watch-public-runtime-hidden.vbs
+scripts/watch-public-runtime.ps1
+```
+
+아래 6개와 ignored `infra/.env.nas-preview`는 절대 stage하지 않는다. NAS 실행 시 env는
+`--nas-env-file D:\workspace\vignette\infra\.env.nas-preview`로 외부 주입한다.
+
+```text
+apps/api/engine.public.err.log.2026-08-07T2200.bak
+apps/api/engine.public.err.log.20260809-160042.bak
+apps/api/engine.public.out.log.2026-08-07T2200.bak
+apps/api/engine.public.out.log.20260809-160042.bak
+apps/web/test-results/g7-voice-consent-desktop.png
+apps/web/test-results/g7-voice-consent-mobile.png
+```
+
+#### 2026-08-09 clean-head 실행 결과 — NAS mutation 0
+
+- dry-run `D:\workspace\vignette-recovery\g8-clean-head-dry-run-20260809.json`: `ok=true`,
+  active `6030a677…c611`, desired archive `6b1b15bd…a3f7`, `deployment_mutated=false`.
+- execute 1 `...\g8-clean-head-execute-20260809.json`: Windows Git archive의 CRLF 때문에 생성 API 타입 byte check가
+  실패했다. archive SHA 검증 후 candidate의 생성 타입/셸 스크립트만 LF로 정규화하도록 controller를 수정했다.
+  NAS mutation 0, rollback 불필요.
+- execute 2 `...\g8-clean-head-execute-20260809-r2.json`: API/types/typecheck/build/candidate stack은 통과했고
+  Playwright는 **109 passed / 5 failed**였다. source-only UUID 스펙 4건은 production build에서
+  `/src/lib/uuid.ts`를 import할 수 없는 gate 배치 오류라 별도 Vite gate로 분리했다. 남은 1건은 아래 제품 버그다.
+  NAS mutation 0, rollback 불필요. 동일 전체 execute를 아직 다시 시도하지 않았다.
+
+#### P0 수정 완료 — 회기 timestamp UTC 전송과 KST 표시 날짜
+
+- 최초 실패 스펙: `session-persistence.spec.ts`의 `persists AI tutor coaching history through reload @single-run`.
+- 코칭 생성·DB 저장·reload 후 `C` 마커까지는 성공했지만, 수정 전 화면이 `9:03:59 / 543:59` 경과로 계산해
+  `회기 시간이 종료됐어요` 모달을 띄웠고 그 모달이 코칭 마커 클릭을 가로막았다.
+- 원인: `apps/api/app/session_read_model.py::iso()`가
+  `datetime.fromtimestamp(ts).isoformat(timespec="seconds")`로 timezone 없는 문자열을 반환한다.
+  `apps/web/src/pages/Session.tsx::elapsedFromSession()`은 `Date.parse(detail.started_at)`로 이를 브라우저 로컬 KST로
+  해석한다. Linux API UTC와 KST 브라우저 사이에서 약 9시간 오차가 생긴다.
+- 수정: `session_read_model.iso()`와 dashboard용 `session_metrics.iso_datetime()`은 UTC `+00:00`을 반환한다.
+  회기 리뷰 달력 날짜는 서버 timezone이 아니라 고정 KST(+09:00)를 사용한다.
+- backend 관련 65 passed, 후속 voice 계약을 포함한 API 전체 **921 passed**, Ruff·compile·web typecheck가 통과했다.
+- 고유 Compose project/volume의 실제 DB/API/engine/browser에서 KST context로 focused 1/1 PASS했다. UTC suffix,
+  `status=active`, `ended_at=null`, 회기 나이 10분 미만, 화면 `00:00-09:59`, timebar/dialog 0,
+  coach mark 실제 클릭과 DB history/source-pack dialog를 모두 검증했다. 종료 뒤 container/volume/listener는 0이다.
+- **테스트 강제 클릭이나 모달 닫기 우회는 사용하지 않았다.** 현재 clean source HEAD `94c681d…7fb`에는 이 수정과
+  controller 변경이 없으므로 사용자에게 commit 승인을 받은 뒤 새 clean commit의 HEAD/tree/archive를 다시 산출한다.
+
+### 6.2 G8: NAS preview 배포와 실제 origin E2E
+
+clean-head release mode가 GREEN이면 전용 NAS preview만 대상으로 백업→dry-run→배포→검증한다. 공개 DB·공개 API는
+이 단계에서 건드리지 않는다. 성공 조건은 다음 전부다.
+
+직전 새 backup은
+`/volume1/docker/vignette-preview-20260807/backups/vignette-preview-pre-clean-head-20260809T051611Z.dump`,
+SHA-256 `72698232d132a8f848d81ff9d8602430e7e623c7646cc236cb39f978aab5d41c`,
+1,015,222 bytes, TOC 1,752다. 하지만 release agent 자체에는 `pg_dump`/`pg_restore` 실행 계약이 없다.
+따라서 **매 execute 직전** 별도 승인된 백업 단계에서 fresh custom dump를 만들고 SHA-256·byte size·TOC parse/count와
+current DB identity를 증거에 결속한 뒤에만 승격한다. 기존 dump 존재만으로 이 단계를 생략하지 않는다.
+
+release agent의 자동 rollback 범위는 exact API/Web image, Compose 적용 상태, active-state 파일뿐이다. 이미 적용된
+DB migration이나 데이터 변경은 자동 복구하지 않는다. migration/data restore는 별도 owner 승인·대상 DB identity·dump
+hash를 갖춘 복원 절차로만 수행한다. 이미지 rollback 성공을 DB rollback 성공으로 기록하면 안 된다.
+
+- 새로운 active SHA와 exact API/Web image ID, predeploy dump SHA, previous image 보존.
+- health 3/3, db/engine true, auth 401, OpenAPI와 G0~G8 route 존재.
+- `http://100.116.83.60:8088` **실제 평문 NAS origin**에서 §8의 회기 E2E 묶음 0 failure.
+- `crypto.randomUUID` 예외 0, error boundary 0, SSE→DB review PASS.
+- 학생 홈→회기→리뷰→G4/G5 반환 연습의 desktop/mobile·DB read reload·멱등·UUID 비노출 유지.
+- 실패 시 자동 rollback과 previous image 복구를 검증하고, 성공 전에는 G8 카드 전체를 DONE으로 바꾸지 않는다.
+
+### 6.3 G7: 외부 종료 Gate
+
+G7 내부 소스 계약은 완료됐고 `scripts/check-g7-external-proof.py`는 현재 의도적으로 exit 1이다.
 네 artifact를 **같은 public host, 겹치는 50분 시간창**으로 수집해야 한다.
 
+먼저 닫아야 할 운영·코드 선행조건이 있다.
+
+- 공개 API는 여전히 119 paths 구버전이며 `/admin/voice-runtime`이 없고(404), `/voice/health`는
+  `openai/gpt-4o-transcribe` + `openai/gpt-4o-mini-tts`다.
+- local Whisper 9882와 MeloTTS 9883 listener는 아직 공개 호스트에 떠 있지 않다. 다만 current source의
+  `start-public-runtime.ps1`는 두 sidecar를 API보다 먼저 시작하고 `local_whisper/small/cpu-int8`,
+  `melotts/melotts-korean` exact provider/model·WS/HTTP readiness를 fail-closed로 확인하며, 기존 비정상 리스너를
+  임의 종료·재사용하지 않는다. Uvicorn도 `--ws websockets --ws-max-queue 4`로 고정했다. source 검증은
+  launcher/sidecar 80/80, API voice 71/71, PowerShell parse·Ruff·compile·diff-check PASS지만 공개 실행은 0회다.
+- **외부 실행 전 코드 P0 3건은 완료:** (1) production 프로세스 exit 0은 canonical checker
+  `returncode == 0 && gate_closed == true`에 결속한다. (2) 실제 브라우저 Origin
+  `https://vignette.chanpaca.net`은 exact HTTPS allowlist로, API/WSS/admin/topology
+  `api-vignette.chanpaca.net`은 별도 transport host와 `wss`/`https` scheme으로 검증한다. (3) 실제 capture 기본·최소를
+  3,120초로 올리고 sampler를 ceil+terminal sample로 계산하며, checker가 voice/runtime/topology 공통 교집합
+  **3,000초 이상**을 강제한다. focused runner 37/37과 통합 G7 166/166을 통과했다.
+- 현재 공개 topology는 Windows host Uvicorn + cloudflared다. 명시적 `windows_host` topology mode는 구현 완료됐다.
+  API/cloudflared의 PID·start time·executable name/SHA256·command-line SHA256·Git SHA·cwd를 pin하고, 각 sample 전후
+  identity와 Git HEAD drift를 검사한다. RSS/peak RSS/CPU/handles/threads, process TCP/established/listener,
+  API listen-port owner/conflict와 host TCP high-water도 수집한다. 기존 `linux_compose`의 api+caddy·fresh-container
+  규칙은 그대로 유지한다.
+- Windows topology focused 검증은 G7 runner/checker/topology 86/86, Ruff, `py_compile`, `git diff --check`를 통과했고 실제
+  read-only adapter가 API 8001 owner=1/conflict=0, cloudflared established TCP>0를 읽었다. raw command line이나
+  endpoint는 저장하지 않았다.
+- **남은 provenance blocker는 배포/실증:** 현재 API cwd는
+  `D:\workspace\vignette-outcome-g7-release-20260807\apps\api`이고 그 release 디렉터리에는 `.git`이 없다. 소스의
+  `-RequireFreshPublicProvenance` 모드는 detached-clean commit/tree와 Python/cloudflared/config SHA를 mutation 전에
+  검증하고, legacy API와 exact-config cloudflared를 bounded stop한 뒤 pinned release cwd에서 새 PID로 교체한다.
+  PID/start/exe SHA/command SHA/실제 cwd를 재검증한 safe receipt에는 raw command line·config 내용을 남기지 않는다.
+  topology artifact도 같은 commit/tree, runner/collector/checker SHA와 `psutil==6.1.1`을 매 sample 전후 결속한다.
+  이 코드는 atomic receipt contract 18/18을 포함한 G7 통합 166/166으로 GREEN이지만 **현재 public에는 아직 실행하지 않았다.**
+  clean commit 전 legacy cwd/Git pin을 약화하거나 기존 PID를 증거로 재사용하지 않는다.
+- watchdog·로그온 boot의 detached-clean source pin 코드는 완료됐지만 실제 task action은 아직 legacy shared
+  source다. clean commit 뒤 `docs/ops/public-runtime-watchdog.md` 순서대로 같은 stable release root에 두 task를
+  재등록하고 commit/tree/script hash marker와 `LastTaskResult=0`을 확인한다. 그 전에는 current
+  `LastTaskResult=1`을 실패가 아니라 안전 차단으로 유지하고, 단일 mutation owner가 public 배포 시간창을 소유한다.
+- 운영 Python에 `psutil`이 없으면 collector는 `command_unavailable:psutil`로 fail-closed한다. current
+  `apps/api/requirements.txt`와 명시적 Python 3.11 모두 `psutil==6.1.1`로 고정됐다.
+- 현재 운영 STT 모델은 이 호스트에서 실측된 CPU int8 `small`로 고정한다. cuDNN 9가 설치되고 별도 성능·정확도
+  gate를 통과하기 전까지 launcher·API runtime metadata·50분 runner/checker expected model을 모두 `small`로 유지한다.
+
 ```powershell
 & $py -X utf8 -B scripts/check-g7-external-proof.py `
   --voice-soak <soak.json> --runtime <runtime.json> `
   --topology <topology.json> --human-voice-gain <pack.json>
 ```
 
-1. `scripts/soak-public-voice-websocket.py` v4 — 운영 Deepgram/OpenAI TTS, authenticated public WSS,
+1. `scripts/soak-public-voice-websocket.py` v4 — 운영 기본값 `local_whisper`/`melotts`의 ready metadata가
+   실제 provider/model과 정확히 일치하는 authenticated public WSS,
    **명시 동의 물리 마이크** 50분 양방향 `passed`. `--confirm-physical-capture` 없이는 장치 열거·캡처를 하지 않는다.
 2. `scripts/capture-g7-runtime-evidence.py` — 같은 시간창의 관리자 endpoint worker/Uvicorn queue high-water.
 3. `scripts/capture-g7-topology-evidence.py` — 같은 host·exact image의 50분 cgroup/proc/Docker/TCP high-water.
-4. 독립 blind human voice-gain pack — 최소 30명 / 50회기 / 150 paired axis / blind evaluator 2인 /
+4. 독립 blind human voice-gain pack — held-out 30명 외 calibration split 참가자 포함 총 최소 31명 /
+   held-out 50회기 / 150 paired axis / blind evaluator 2인 /
    ICC(A,1) ≥ 0.75 · κ ≥ 0.70 · gain ≥ 0.01 · participant-cluster bootstrap 10,000회 95% CI lower > 0.
 
 준비 상세는 `docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md`.
 
+G7 Windows topology 회귀 명령:
+
+```powershell
+Set-Location D:\workspace\vignette
+$env:PYTHONPATH='D:\workspace\vignette\apps\api'
+& $py -X utf8 -m unittest scripts/test_g7_external_proof.py scripts/test_g7_topology_evidence.py `
+  scripts/test_g7_runtime_evidence.py scripts/test_g7_external_voice_soak.py `
+  scripts/test_run_g7_external_proof_window.py apps/api/app/test_g7_voice_gain_evidence.py
+& $ruff check scripts/capture-g7-topology-evidence.py scripts/check-g7-external-proof.py `
+  scripts/run-g7-external-proof-window.py scripts/test_g7_topology_evidence.py `
+  scripts/test_g7_external_proof.py scripts/test_run_g7_external_proof_window.py
+```
+
 **사용자에게 받아야 하는 것 (코드로 대체 불가):**
 
-- 운영 Deepgram key·quota 사용 권한
 - authenticated learner/admin session 또는 안전한 `storageState` 생성 협조
 - 물리 마이크 50분 실행에 대한 **명시적 동의**
 - 실제 참가자·독립 평가자 운영 승인
@@ -220,7 +530,7 @@ $py = 'C:\Users\encep\AppData\Local\Programs\Python\Python311\python.exe'
 $ruff = 'C:\Users\encep\AppData\Local\hermes\hermes-agent\venv\Scripts\ruff.exe'
 ```
 
-### Backend full — 기준 API **898 passed**, gateway **58 passed**
+### Backend full — 기준 API **921 passed**, gateway **58 passed**
 
 ```powershell
 Set-Location D:\workspace\vignette\apps\api
@@ -228,7 +538,7 @@ Set-Location D:\workspace\vignette\apps\api
 & $py -X utf8 -B -m pytest -p no:cacheprovider engine_gateway -q
 ```
 
-### G8 executor/probe/helper/release governance — 기준 28 / 11 / 37 / 21
+### G8 executor/probe/helper/release governance — 기준 28 / 11 / 37 / 30
 
 ```powershell
 Set-Location D:\workspace\vignette
@@ -248,6 +558,89 @@ npm run typecheck
 npm run build
 ```
 
+### 현재 HEAD 학생 UX·접근성 focused — 기준 **20/20**
+
+2026-08-09 읽기 전용 재감사에서 `check:api-types`·typecheck·build와 아래 fixture-only 묶음이 desktop/mobile
+20/20을 통과했다: Alliance Pulse 8, 자기주도 폐루프 2, insecure-origin UUID 6, pre/mid 자기점검 2,
+시간만료 경고·종료 모달 2. 390×844·320×568 overflow 0, tab 키보드, Enter CTA, 44px 조작부,
+4.5:1 대비, raw UUID/theory key 비노출, 동의 전 `getUserMedia`/`enumerateDevices` 0도 확인했다.
+
+추가 회귀에서 새 음성 동의 modal을 실제로 수락한 뒤 위기 음성 종료까지 가는 desktop/mobile, 모바일 review
+filter 44px 계약을 desktop/mobile로 검증해 4/4 통과했다. dashboard의 file-origin은 spec-relative repo root로
+고정했고, session-review fixture 소유권과 viewport assertion, admin live snapshot race를 교정했다. 16:49 단일 실행은
+**120/120 PASS(92.0s)**였지만, 그 뒤 dashboard 변경분은 dashboard 10/10으로만 따로 통과했다. 따라서 현 트리는
+110 불변 + 10 최신 분할 GREEN이고, 최종 clean source에서 아래 exact 묶음을 다시 단일 실행해 HEAD/tree/archive
+결속 뒤 120/120을 요구한다.
+
+#### current-source fixture exact 120 — clean HEAD 재현 명령
+
+정확한 수집 구성은 `dev-dashboard` 10 + `session-mvp` 24 + `session-review` 24 + `learner` 14 +
+`session-layout` 8 + `admin` 40 = desktop/mobile 120이다. `127.0.0.1:8000`은 반드시 복구 dump에서 만든
+**disposable API/DB/engine 전용 스택**이어야 한다. 이 묶음은 dev-login·세션 쓰기를 포함할 수 있으므로 public
+8001, 복구 원본 55432, candidate DB, NAS DB에 연결하지 않는다.
+
+```powershell
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
+$OutputEncoding = [Text.UTF8Encoding]::new($false)
+$cleanRoot = 'D:\workspace\vignette-clean-<NEW_SHA>'
+$cleanWeb = Join-Path $cleanRoot 'apps\web'
+$tempRoot = Join-Path $env:TEMP 'vignette-clean-fixture-120'
+$tempWeb = Join-Path $tempRoot 'apps\web'
+$tempEvidence = Join-Path $tempRoot 'docs\ops\evidence'
+if (Test-Path -LiteralPath $tempRoot) { throw "기존 TEMP와 충돌: $tempRoot" }
+$pw = Join-Path $cleanWeb 'node_modules\.bin\playwright.cmd'
+if (-not (Test-Path -LiteralPath $pw -PathType Leaf)) {
+  throw 'clean worktree에서 npm ci --ignore-scripts를 먼저 실행해 node_modules를 준비할 것'
+}
+$health = Invoke-RestMethod -Uri 'http://127.0.0.1:8000/health' -TimeoutSec 5
+if ($health.status -ne 'ok' -or -not $health.db -or -not $health.engine) {
+  throw 'disposable API8000의 db/engine ready가 아님'
+}
+New-Item -ItemType Directory -Path $tempWeb -Force | Out-Null
+New-Item -ItemType Directory -Path $tempEvidence -Force | Out-Null
+$config = Join-Path $cleanWeb 'playwright.config.ts'
+$files = @(
+  'e2e/dev-dashboard.spec.ts',
+  'e2e/session-mvp.spec.ts',
+  'e2e/session-review.spec.ts',
+  'e2e/learner.spec.ts',
+  'e2e/session-layout.spec.ts',
+  'e2e/admin.spec.ts'
+)
+$env:PLAYWRIGHT_PORT = '15374'
+$env:VITE_API_PROXY_TARGET = 'http://127.0.0.1:8000'
+Remove-Item Env:PLAYWRIGHT_BASE_URL -ErrorAction SilentlyContinue
+Remove-Item Env:PLAYWRIGHT_SKIP_WEB_SERVER -ErrorAction SilentlyContinue
+$code = 99
+try {
+  Push-Location $tempWeb
+  try {
+    & $pw test @files ("--config={0}" -f $config) `
+      --project=chromium-desktop --project=chromium-mobile `
+      --workers=4 --reporter=line ("--output={0}" -f (Join-Path $tempRoot 'pw-results'))
+    $code = $LASTEXITCODE
+  } finally {
+    Pop-Location
+  }
+} finally {
+  $listeners = @(Get-NetTCPConnection -State Listen -LocalPort 15374 -ErrorAction SilentlyContinue)
+  $listenerError = $null
+  if ($listeners.Count -ne 0) { $listenerError = "Playwright Vite listener 잔존: $($listeners.OwningProcess -join ',')" }
+  if (Test-Path -LiteralPath $tempRoot) {
+    $resolved = (Resolve-Path -LiteralPath $tempRoot).Path
+    if ($resolved -ne $tempRoot) { throw "unexpected TEMP target: $resolved" }
+    [IO.Directory]::Delete($tempRoot, $true)
+  }
+  if ($listenerError) { throw $listenerError }
+}
+if ($code -ne 0) { throw "clean fixture 120 failed: $code" }
+```
+
+과거 API-ready 없이 돌린 별도 Vite-only 혼합 실행의 `session-layout` 8건은 DB persona가 없어 제품 assertion 전에
+`seed_fallback/degraded`로 중단됐다. 위 exact 120 명령은 이 사각지대를 닫기 위해 disposable API의 db/engine health를
+선행 강제한다. 최종 완료 때는 `session-layout` 8/8과 returned-practice DB closed-loop 4/4를 모두 다시 통과시킨다.
+
 ### Dashboard SSOT + E2E — 기준 SSOT PASS(FAIL 0), unit 5/5, dashboard 10/10
 
 ```powershell
@@ -275,7 +668,7 @@ node.exe .\node_modules\@playwright\test\cli.js test e2e/session-layout.spec.ts
   --project=chromium-desktop --project=chromium-mobile --project=chromium-single-run --workers=1 --reporter=line
 ```
 
-전체 Playwright inventory는 610 tests / 44 files다. 실행 환경/API/DB를 정확히 맞추지 않고 fixture failure를
+전체 Playwright inventory는 614 tests / 44 files다. 실행 환경/API/DB를 정확히 맞추지 않고 fixture failure를
 제품 failure로 오인하지 않는다. 같은 blocker가 두 번 반복되면 전체 재시도 대신 원인·증거·수정 계획을 먼저 보고한다.
 
 ## 9. 핵심 변경 파일
@@ -286,9 +679,18 @@ node.exe .\node_modules\@playwright\test\cli.js test e2e/session-layout.spec.ts
 - `scripts/run-outcome-os-release-agent.py` · `scripts/test_outcome_os_release_agent.py`
 - `scripts/check-dev-dashboard-ssot.py` · `scripts/test_dev_dashboard_ssot.py`
 - `scripts/check-g7-external-proof.py` · `scripts/soak-public-voice-websocket.py` ·
-  `scripts/capture-g7-runtime-evidence.py` · `scripts/capture-g7-topology-evidence.py`
+  `scripts/capture-g7-runtime-evidence.py` · `scripts/capture-g7-topology-evidence.py` ·
+  `scripts/run-g7-external-proof-window.py`와 대응 G7 테스트 3개
 - `apps/web/src/lib/uuid.ts` · `apps/web/e2e/insecure-context-uuid.spec.ts` (신규, 비-secure origin 결함 수정)
-- `apps/web/e2e/dev-dashboard.spec.ts` · `apps/web/e2e/returned-practice-db-closed-loop.spec.ts` ·
+- `apps/api/app/session_read_model.py` · `apps/api/app/services/session_metrics.py` ·
+  `apps/api/app/test_session_read_model.py` · `apps/web/e2e/session-persistence.spec.ts` (UTC/KST P0와 실DB browser 회귀)
+- `apps/web/index.html` · `apps/web/e2e/self-directed-learning-loop.spec.ts` (SPA route 전환 중 boot diagnostic 회복)
+- `apps/web/e2e/admin.spec.ts` · `apps/web/e2e/dev-dashboard.spec.ts` ·
+  `apps/web/e2e/session-review-fixture.ts` · `apps/web/e2e/session-review.spec.ts`
+- `scripts/watch-public-runtime.ps1` · `scripts/boot-public-runtime.ps1` ·
+  `scripts/install-public-runtime-task.ps1` · `scripts/register-boot-task.ps1` ·
+  `scripts/watch-public-runtime-hidden.vbs` · `scripts/test_public_runtime_watchdog_provenance.py`
+- `apps/web/e2e/returned-practice-db-closed-loop.spec.ts` ·
   `apps/web/e2e/harness/prepare-returned-practice-db.py`
 - `docs/dev_dashboard.html` · `docs/TODO.md` · `docs/README.md` · `docs/ops/backlog-2026-06-26.md`
 - `docs/ops/nas-preview-g8-rollback-proof-runbook.md` ·
@@ -303,3 +705,69 @@ node.exe .\node_modules\@playwright\test\cli.js test e2e/session-layout.spec.ts
 - G7 물리 마이크·사람 평가를 무동의/합성 데이터로 대체하지 않는다.
 - current/previous images와 DB backup을 확인하기 전 destructive operation을 실행하지 않는다.
 - 성공보다 정직한 fail-closed 증거가 우선이다.
+
+## 11. 권장 멀티에이전트 실행 구조
+
+사람 개발자 작업계획은 만들지 않는다. 구현·테스트·배포·증거 동기화는 에이전트가 수행하고, 사람에게는 코드로
+대체 불가능한 동의·인증 세션·실제 참가자/평가자 승인만 요청한다. 동시 작업은 최대 세 하위 lane으로 나누되,
+NAS/public/DB mutation owner는 항상 한 에이전트만 둔다.
+
+1. **G8 release lane:** clean-head release mode 구현·unit·dry-run·NAS preview 배포·NAS-origin E2E. 이 lane만 NAS mutation.
+2. **G7 proof lane:** current public route/config 감사, local provider readiness, `--rehearse`, 네 artifact 수집 준비.
+   실제 마이크는 사용자 명시 동의 전 0회, public mutation은 G8 lane과 시간 겹치지 않게 단일 owner에게 인계.
+3. **E2E/SSOT lane:** local fixture, disposable DB browser, visual/accessibility, dashboard/TODO/backlog 정합을 읽기 전용으로 감사.
+
+루트 에이전트는 각 lane의 증거 SHA와 실패 원인을 합쳐 게이트를 판정한다. 같은 blocker가 두 번 반복되면 세 번째
+재시도 전에 원인·증거·수정 계획을 사용자에게 보고한다.
+
+## 12. 새 에이전트에 그대로 줄 시작 프롬프트
+
+```text
+D:\workspace\vignette의 docs/HANDOFF.md를 인수인계 SSOT로 읽고, AGENTS.md → docs/README.md →
+docs/dev_dashboard.html → docs/TODO.md → docs/ops/backlog-2026-06-26.md 순서로 현재 상태를 재확인해.
+
+현재 master는 HEAD 94c681d…7fb이고 origin/master보다 2 commit 앞서며, timestamp·voice provider/model,
+G7 topology·public launcher·G8 clean-head·SSOT가
+아직 tracked dirty다. 기존 D:\workspace\vignette-clean-head-94c681d와 g8-focus-head-94c681d.tar는 이 최신 변경을
+포함하지 않으므로 배포 입력으로 사용하지 마. 먼저 git status/diff와 각 lane의 focused test를 재확인해.
+
+최종 목표는 G0~G8 아홉 목표를 코드-only가 아니라 실제 runtime 증거로 모두 닫는 것이다. G0~G6은 현재 내부 DONE
+증거를 보존하되 새 clean HEAD 전체 회귀로 재확인해. G8 rollback receipt와 clean-head controller는 구현됐지만
+2026-08-09 execute 두 번은 모두 NAS mutation 전에 fail-closed됐다. docs/HANDOFF.md §6.1의 naive
+session timestamp 버그는 UTC/KST 계약과 focused disposable DB/API/browser E2E로 GREEN이다. 테스트 강제 클릭 우회는
+없다. 사용자 승인을 받아 이 변경을 새 clean commit으로 만들고 HEAD/tree/archive를 다시 결속해 격리 NAS preview에
+배포한 다음 실제 NAS HTTP origin의 전체 회기 E2E를 0 failure로 통과시켜. G7은 내부 구현만 DONE이다. current source 공개 배포,
+local_whisper/melotts ready, authenticated public WSS, 사용자의 명시 동의를 받은 물리 마이크 50분 soak,
+같은 시간창의 runtime/topology high-water, 독립 human voice-gain pack까지 모아 canonical checker exit 0을 만들어야 한다.
+G7 runner exit의 checker exit 0/gate_closed 결속, browser Origin과 API/WSS host 분리, 3,120초 capture와
+3,000초 공통 overlap, detached-clean HEAD/tree, runner/collector/checker SHA와 exact psutil pin은 소스에서 완료됐다.
+API/cloudflared는 legacy PID를 재사용하지 말고 `-RequireFreshPublicProvenance`로 pinned release cwd에서 강제
+재시작해 새 PID/start/exe/command SHA/cwd safe receipt를 결속해.
+G7 runner/checker/topology는 86/86, public launcher/sidecar 계약은 80/80, 통합은 166/166, API voice 통합은 71/71로 구현됐지만
+현재 public API의 Git 없는 냉동 release cwd는 provenance gate를
+통과하지 못한다. current committed repo 기반 launcher/runtime으로 정렬하거나 동등하게 강한 provenance를 구현하고,
+cwd/Git pin이나 기존 Linux Compose gate를 약화하지 마. 합성 증거로 G7을 DONE 처리하지 마.
+public task source-pin 코드는 구현됐다. watchdog·로그온 boot는 detached clean release와 exact Git commit/tree,
+watchdog|boot/start script SHA가 없으면 mutation 전에 실패한다. 하지만 실제 두 Scheduled Task action은 아직 shared
+worktree와 legacy 인자를 가리키며, 5분 watchdog은 최신 실행에서 pin 인자 부재로 `LastTaskResult=1`이다. public은
+현재 health ok지만 자동복구는 의도적으로 fail-closed다. clean commit 뒤 동일 stable release root로 두 task를
+재등록하고 action pin·watchdog result 0·로그온/reboot smoke를 증명한 뒤에만 runtime DONE으로 바꿔.
+
+NAS 17:07 기준선은 active 6030a677…c611, API/Web 52e0…8b2d/6fdb…f215, previous images 보존,
+Compose 4개 running+unless-stopped, volume vignette-preview-20260807_pgdata, health/routes/assets GREEN, helper/listener 0이다.
+release agent는 DB dump/restore를 지원하지 않으므로 execute 직전 fresh custom dump SHA/size/TOC와 DB identity를
+별도로 결속해. 자동 rollback은 image/Compose/active-state뿐이고 migration/data restore는 별도 owner 승인이야.
+remote release root/Compose mode 0777 P1도 최소권한 preflight로 닫기 전에는 execute하지 마.
+
+학생 자기주도 폐루프는 홈 추천→회기→리뷰→G4 처방/G5 전이→별도 재연습→completed-session observer→
+actual attempt/execution→read-model reload→before/after·멱등까지 desktop/mobile 실제 DB/browser로 검증해.
+최종 검증은 API full, gateway full, schema/provenance, Web API types/typecheck/build, fixture E2E, disposable DB E2E,
+NAS-origin E2E, visual/accessibility, auth/OpenAPI/assets/SSE→DB review를 포함해야 한다.
+
+독립 작업은 서브에이전트로 병렬화하되 NAS/public/DB mutation은 단일 owner만 수행해. 공개 DB 복구 volume과
+pre-recovery container/dumps, NAS named volume과 previous images는 삭제하지 마. 비밀/PII/raw UUID를 증거에 남기지 마.
+과거 로컬 recovery dump 경로는 인계 시점에 보이지 않으므로 삭제로 단정하거나 그 파일을 전제로 복원하지 말고,
+off-host/NAS 보관 위치와 새 backup 목적지를 먼저 확인해.
+source-only PASS나 health-only를 DONE으로 부르지 말고, 대시보드·TODO·backlog·HANDOFF를 마지막 증거와 함께 동기화해.
+모든 게이트가 실제로 닫히기 전에는 goal complete를 선언하지 마.
+```
diff --git a/docs/TODO.md b/docs/TODO.md
index 8810636..8806eb9 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -14,10 +14,18 @@
 > 출처: `ops/backlog-2026-06-26.md` B2 · 대시보드 운영 탭 · `ops/tailscale-vnet-runtime-2026-06-27.md` · `ops/public-runtime-watchdog.md` · `HANDOFF.md`
 
 - [ ] **공개 DB 계정·회기 복구 안정화** — 2026-08-07 18:26 KST owner 승인으로 recovered named volume을
-  공개 `vignette-dev-db:55432`에 전환했다. public 기준 users 84/sessions 30/turns 705,
+  공개 `vignette-dev-db:55432`에 전환했다. cutover 기준 users 84/sessions 30/turns 705,
   Google 계정 16/소유 회기 30, orphan 0, health·engine·OAuth·watchdog가 정상이다. 전환 직전 container와
   dump, 원본 volume을 보존한다. 남은 것은 사용자가 Google 재로그인한 뒤 본인 과거 회기가 보이는지
   확인하는 일과 자동 백업 운영화다. 기존 인증 세션은 복사하지 않아 재로그인이 필요하다.
+  2026-08-09 Docker Desktop 중단과 18:02:55 KST Docker Desktop UI의 active DB 직접 stop으로 `db=false`가
+  재발했으나 동일 recovered container/volume만 재기동했고, 현재 owner read-only 집계는 users 356/sessions 193/
+  turns 726, Google users 16/Google-owned sessions 31이며 public db/engine true다. watchdog·로그온 boot는 detached
+  clean release의 Git commit/tree와 watchdog|boot/start SHA가 없으면 mutation 전에 실패하도록 코드로 고정했다.
+  실제 두 Scheduled Task action은 아직 shared worktree라 watchdog 반복 실행은 의도적으로
+  `LastTaskResult=1`이다. 18:05 KST 복구 뒤 local/public health는 `status=ok·db=true·engine=true`, 공개 OpenAPI는
+  119 paths지만 `/voice/health`는 OpenAI STT/TTS이고 local voice sidecar listener 9882/9883은 0이다.
+  clean commit 뒤 동일 stable release root로 두 task를 재등록하기 전까지 자동복구는 DONE이 아니다.
   상세: `ops/public-db-recovery-rehearsal-2026-08-07.md`.
 - [ ] **자동 DB 백업·정기 복원 리허설** — `scripts/backup-vignette-db.ps1`의 custom dump→TOC 검증→
   SHA manifest 원자 게시와 현재 public-target 일회용 복원(129 tables/9,646 rows/orphan 0)을 통과했다.
@@ -60,7 +68,9 @@
   `CLAUDE_BIN` 부재로 기동)에서 `/health`는 `ok:true`로 통과하고 `/ready`는 503으로 검출되어
   워치독이 `unhealthy (1/3)` + 503 본문을 남겼다.
   남은 것: NAS용 9100은 실사용 세션 7개가 있어 미접촉이라 (2)는 다음 재기동 때 반영된다.
-- [ ] **재부팅 후 watchdog smoke** — 실제 Windows 재부팅 후 엔진/API/터널 자동 복구 + public `/turn` 실측.
+- [ ] **stable-source task 재등록 + 재부팅 후 watchdog smoke** — 사용자 승인 clean commit의 detached release root에
+  watchdog·로그온 boot task를 함께 재등록하고 action의 commit/tree/script SHA pin, 5분 watchdog
+  `LastTaskResult=0`, 로그온 boot, 실제 Windows 재부팅 후 엔진/API/터널 자동 복구 + public `/turn`을 실측한다.
   DNS 개통 후 `api-vnet.18ka.net`을 `-AdditionalPublicHealthUrls`로 명시 추가.
 - [x] **노트북 로컬 음성 스택 STT 구현** — 2026-08-08 소유자 결정으로 음성 양쪽을 노트북 상주
   로컬 모델로 쓴다(STT faster-whisper, TTS는 아래 항목대로 MeloTTS). 이전에는 코드에 로컬 STT 경로가 아예 없었고
@@ -69,7 +79,7 @@
   `voice_stt_provider=local_whisper` 경로를 추가했다. 오디오는 호스트를 벗어나지 않고 외부 STT 키가
   필요 없다. 실측: 저장소 합성 시드 음성 8.72초로 interim 9 · final 5 · word timestamp 12개 전부 present,
   전사는 원문과 한 글자(`안녕하세요`→`안녕하세여`) 차이였다. 회귀 `scripts/test_local_whisper_stt_server.py`
-  37/37, `apps/api/app/test_voice_service.py` 로컬 provider 케이스 포함 API 전체 908 passed.
+  37/37, `apps/api/app/test_voice_service.py` 로컬 provider 케이스와 후속 계약을 포함한 current API 전체 921 passed.
   **발견 1:** 이 노트북은 CUDA 장치는 보이지만 cuDNN(`cudnn_ops64_9.dll`)이 없어 GPU 추론이 **네이티브
   크래시**로 죽는다. 같은 프로세스 try/except로는 못 잡아서 디바이스 확인을 버릴 수 있는 자식 프로세스
   (`--self-check`)로 분리하고 `auto`에서 CPU로 폴백하게 했다. cuDNN 9를 설치하면 GPU(float16)로 훨씬
@@ -84,19 +94,20 @@
   사전학습 다화자 모델이라 Higgs처럼 P1 프리셋 한정이 아니라 모든 페르소나에 적용된다.
   **실측:** CPU 정상 상태 RTF 0.27~0.28(실시간의 3.6배), `POST /tts` 200·WAV 350,566 bytes·3.61s,
   빈 텍스트 422·미지 경로 404. **왕복 검증**으로 MeloTTS 합성음을 faster-whisper가 완전 일치 전사했다.
-  회귀 사이드카 16/16, API 전체 914 passed, ruff clean.
+  회귀 사이드카 16/16, 후속 계약을 포함한 current API 전체 921 passed, ruff clean.
   **검토 후 탈락:** Kokoro-82M은 Apache 2.0이지만 공식 `VOICES.md`에 **한국어가 없다**(검색 요약이
   지원한다고 했으나 오답). Piper는 GPL, XTTS-v2·Fish Speech는 비상업이라 Higgs와 같은 문제다.
   설치 함정 3가지는 `decisions/local-voice-stack.md`에 남겼다(setuptools<81, unidic download, eunjeon).
   근거: [`decisions/local-voice-stack.md`](./decisions/local-voice-stack.md).
-- [ ] **G7 외부 종료 게이트 — 남은 것은 사람 입력 둘뿐** — provider 의존은 해소됐다. 2026-08-08 로컬 스택
+- [ ] **G7 외부 종료 게이트 — 공개 runtime 선행 구현 + 사람 입력** — provider 의존 코드는 해소됐다. 2026-08-08 로컬 스택
   (faster-whisper STT + MeloTTS TTS, 둘 다 MIT)으로 바꿔 외부 STT 키가 더 이상 필요 없고, 체커의 벤더
   하드코딩도 운영 provider 허용목록으로 교정했다. 기계적인 부분도
   `scripts/run-g7-external-proof-window.py`가 soak·runtime·topology 세 캡처를 **하나의 겹치는 시간창**에서
   동시에 돌리고 checker까지 이어서 실행하도록 묶었다(회귀 20/20).
-  **남은 것은 코드로 만들 수 없는 둘이다.**
+  사람에게서만 받을 수 있는 마지막 두 입력은 다음이다.
   (1) **명시 동의 하 물리 마이크 50분 양방향 soak** — 소유자가 실제로 50분 발화해야 한다.
-  (2) **독립 blind human voice-gain pack** — 참가자 30명 / 50회기 / 150 paired axis / 독립 평가자 2인 /
+  (2) **독립 blind human voice-gain pack** — held-out 30명 외 calibration split 참가자 포함 총 최소 31명 /
+  held-out 50회기 / 150 paired axis / 독립 평가자 2인 /
   ICC(A,1) ≥ 0.75 · κ ≥ 0.70 · gain ≥ 0.01 · participant-cluster bootstrap 10,000회 95% CI lower > 0.
   **선행 조건(2026-08-08 발견):** 공개 런타임은 119 paths 구버전이라 `/admin/voice-runtime`이
   배포돼 있지 않다. 마이크와 사람을 다 준비해도 오늘 실행하면 50분을 버리고 artifact 2에서 실패한다.
@@ -104,10 +115,36 @@
   오케스트레이터가 시작 전에 `admin_voice_runtime_not_deployed`로 막는다 — 실측 exit 2.
   이 판정은 미인증 HTTP 상태가 아니라 OpenAPI `paths`로 한다. Cloudflare가 자동화 클라이언트에
   모든 경로를 403(error 1010)으로 주기 때문에 상태 코드로는 배포 누락을 알 수 없다.
-  실행 전 `--rehearse`로 배관을 먼저 검증한다. fail-closed 경계 4종(동의 없음·pack 없음·50분 미만·host
-  불일치)은 CLI로 실증했다. 상세: `ops/outcome-os-g7-external-proof-readiness-2026-08-07.md`.
+  2026-08-09 재감사에서 공개 `/voice/health`는 여전히 OpenAI STT/TTS이고 local Whisper 9882·MeloTTS
+  9883 listener가 없음을 확인했다. current source에는 sidecar-before-API lifecycle, exact
+  `local_whisper/small/cpu-int8`·`melotts/melotts-korean` readiness, provider env와 Uvicorn
+  `--ws websockets --ws-max-queue 4`를 fail-closed로 연결했다(launcher/sidecar 80/80, API voice 71/71).
+  Windows host topology mode도 PID/start/exe·command SHA/cwd와 process/TCP high-water를 검증한다.
+  하지만 이 source를 공개에 배포한 적은 없고, 현재 API의 Git 없는 냉동 release cwd는 provenance gate를 통과하지
+  못한다. current committed repo 기반으로 공개 runtime을 정렬한 뒤에만 50분 창을 연다.
+  **외부 실행 전 코드 P0 완료:** runner 종료 코드는 canonical checker `exit 0`/`gate_closed=true`에 결속됐고,
+  브라우저 Origin(`vignette.chanpaca.net`)은 API/WSS/admin/topology host(`api-vignette.chanpaca.net`)와 분리된 HTTPS
+  allowlist로 검증한다. 실제 capture는 최소 3,120초·ceil+terminal sample이고 voice/runtime/topology 공통 overlap
+  `≥3000s`를 checker가 강제한다. Windows artifact는 detached-clean HEAD/tree, runner/collector/checker SHA,
+  exact `psutil==6.1.1`을 매 sample 전후 pin한다. fresh launcher는 legacy API와 exact-config cloudflared를 bounded
+  교체하고 새 PID/start/exe/command SHA/실제 cwd의 raw command-line 없는 receipt를 만든다. G7 runner/checker/topology
+  86/86, launcher/sidecar 80/80, 통합 166/166을 통과했다. 실제 공개 실행 전 `--rehearse`로 배관을 먼저 검증한다.
+  fail-closed 경계(동의 없음·pack 없음·3,120초 미만·host/Origin/scheme 불일치)는 CLI로 실증했다. 상세:
+  `ops/outcome-os-g7-external-proof-readiness-2026-08-07.md`.
 
-> **완료된 격리 검증 경로:** NAS 프리뷰 `http://100.116.83.60:8088`을 전용 Compose 프로젝트·포트·네트워크·볼륨에 배포하고 실제 브라우저 회기와 review API 저장 축어록을 확인했다. current source exact SHA `6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611`은 전체 browser E2E 108/108, postdeploy SSE→DB review, health 3/3, OpenAPI 126·auth 401·G0~G8 route를 통과했다. 기존 프로젝트를 대상으로 한 중단·재생성 명령은 실행하지 않았다. 매일 04:30 KST `Vignette 회기 E2E 정기 검증`(automation id `vignette-e2e`)은 ACTIVE다. 새 기능이 material milestone이고 release-only patch 결정성·manifest checker·canonical clean-index·NAS preflight를 통과하며 배포 SHA가 달라질 때만 같은 격리 프리뷰를 갱신한다. 첫 스케줄 실행 이력은 아직 증거에 포함하지 않았다. 증거: [배포 증거](./ops/nas-preview-deployment-evidence-2026-08-07.md), [current 기계 판독 증거](./ops/evidence/nas-preview-current-deploy-2026-08-07.json), [브라우저 증거](./ops/evidence/nas-preview-live-turn-2026-08-07.png). 이는 G8 실제 receipt-bound rollback이나 미승인 물리 마이크·부재한 Deepgram 운영 키를 대체하지 않는다.
+> **격리 NAS current baseline / G8 `runtime REVALIDATION`:** 2026-08-09 17:07 KST 프리뷰
+> `http://100.116.83.60:8088`, project `vignette-preview-20260807`은 active SHA `6030a677…c611`, exact
+> API/Web `52e0…8b2d`/`6fdb…f215`로 실행 중이며 previous `79ec…4450`/`c530…2f28`도 보존한다.
+> `api/web/db/proxy` 4개는 running + `unless-stopped`, volume은 `vignette-preview-20260807_pgdata`다.
+> health 3/3·db/engine true·auth 401·OpenAPI 126 + G1~G8 routes·root/JS/CSS 200, helper/listener는 모두 0이다.
+> 보존 dump는 `92ed…1570f` 960,970 bytes와 `726982…5d41c` 1,015,222 bytes다. release agent는 DB
+> dump/restore를 수행하지 않으므로 매 execute 직전 fresh custom dump SHA/size/TOC와 DB identity를 별도 결속한다.
+> 자동 rollback은 image/Compose/active-state만 복구하며 적용 migration/data restore는 별도 owner 승인이 필요하다.
+> remote release root/Compose mode `0777`은 P1 권한 위험이므로 execute 전 최소권한·preflight를 닫는다. localhost
+> candidate 108/108과 postdeploy SSE→DB review는 과거 증거이고, 같은 SHA의 평문 origin은 UUID 결함 24건 실패라
+> current source의 완료 증거가 아니다. `randomUuid()` 수정 배포와 NAS-origin 전체 회기·SSE→DB·G4/G5
+> returned-practice 0 failure 전에는 G8을 DONE으로 바꾸지 않는다. 매일 04:30 KST `vignette-e2e` 자동화는 ACTIVE다.
+> 증거: [배포 증거](./ops/nas-preview-deployment-evidence-2026-08-07.md), [기계 판독 증거](./ops/evidence/nas-preview-current-deploy-2026-08-07.json), [브라우저 증거](./ops/evidence/nas-preview-live-turn-2026-08-07.png). 이는 G7 물리 마이크·독립 사람 평가 증거를 대체하지 않는다.
 - [ ] **claude_cli ↔ Anthropic API live 동일성** — provider 라우팅·모델 탐색·설정 저장 경로는 구현 완료. 남은 게이트는 연구팀/기관 `ANTHROPIC_API_KEY`를 게이트웨이 호스트에 주입한 뒤 같은 프롬프트의 live 응답·계량·오류 표면화를 비교하는 것이다.
 
 ## B. 외부 거버넌스  [외부]
@@ -364,12 +401,13 @@
 - [x] 텍스트·음성 평가 독립 산출 후 calibrated fusion 구현.
 - [x] 장면별 오디오 재생과 음성 재연습 구현.
 - [x] 비언어 특징의 과도한 임상 추론 차단 계약·테스트 구현.
-- [x] Deepgram streaming STT adapter, interim/final·word timestamp·provider event 계약과 OpenAI batch fallback 구현.
+- [x] Deepgram streaming STT adapter와 OpenAI batch fallback을 보존하고, 운영 기본 경로를 노트북 상주
+  `local_whisper`/`melotts`로 전환해 interim/final·word timestamp·provider event 계약을 동일하게 구현.
 - [x] 저장 word token을 deployment `SESSION_SECRET` 기반 HMAC-SHA256 pseudonym으로 전환하고 원문 미보존을 고정.
 - [x] 열린 streaming 중 동의를 1초마다 재검사해 철회 시 provider 전송·후속 저장을 중단하는 fail-closed 계약 구현.
 - [x] 음성 단절/실패 뒤 작성 중 텍스트를 보존하고 텍스트 계속하기·키보드 가능한 음성 재연결 recovery UX 구현.
-- [x] 운영 TTS를 OpenAI API `gpt-4o-mini-tts`로 고정하고 공식 Services Agreement의 앱 통합·출력 소유 근거와
-  최종 사용자 AI 생성 음성 고지를 제품·증거 계약에 반영.
+- [x] 외부 OpenAI TTS adapter와 AI 생성 음성 고지를 보존하면서, 운영 기본 TTS를 상업 사용 가능한
+  MeloTTS Korean(MIT) loopback 사이드카로 전환.
 - [x] authenticated WSS `ready`에 STT/TTS provider·model을 노출하고, 마이크 열거·캡처 없는 public preflight가
   네 기대값과의 정확 일치를 검사하도록 구현. full soak만 명시적 `--confirm-physical-capture` 뒤 장치를 연다.
 - [x] synthetic gold target에 대해 text-only와 calibrated multimodal 출력을 직접 비교하는 1-MAE benchmark를
@@ -397,7 +435,7 @@
   격리 synthetic PCM soak는 59/59 연결 종료·성공 발화 55·철회 차단 2·미동의 차단 1·overflow 거부/복구 1/1,
   focused 119 passed를 통과했다. 공개 G7 route는 TLS 1.3 handshake·비인증 1008·Cloudflare edge와 마이크
   열거/캡처 0을 확인했다. 증거: `ops/evidence/g7-public-wss-preflight-current-20260807.json`.
-  **남음:** 실제 Deepgram 운영 key·quota와 live interim/final, 기대값과 일치하는 authenticated public WSS ready,
+  **남음:** current source의 공개 배포와 `local_whisper`/`melotts` ready metadata 일치, authenticated public WSS ready,
   사용자의 명시 동의를 받은 물리 마이크, 실행된 50분 양방향 soak, 독립 라벨 held-out/pilot의 실제 음성 이득,
   실제 worker·Uvicorn·OS·Cloudflare edge를 같은 50분 시간창으로 묶은 RSS/CPU/queue high-water.
   preflight·synthetic·옵션 제공만으로 종료하지 않는다.
@@ -416,7 +454,7 @@
   semantic runtime/browser proof, 이미지 rollback, exact-SHA SSOT handoff를 fail-closed로 구현·독립 감사.
 - [x] 위 release agent로 변경 SHA `e9b482ccba616a610c1f4862366d44aabae20ee8c82d8ef7f2cf16069f2d6e99`를
   실제 격리 NAS에 승격하고 postdeploy browser·DB review·rollback snapshot·exact-SHA SSOT handoff를 남겼다.
-- [x] **G8 종료 GATE 재검증** — source→draft→red-team→benchmark→catalog 재현, 정답 누수·PII·무근거
+- [x] **G8 내부 구현·실제 rollback receipt GATE** — source→draft→red-team→benchmark→catalog 재현, 정답 누수·PII·무근거
   임상 주장 0건, 모델 교체 자동 calibration/rollback, 운영 오류의 재현 테스트·backlog DAG 자동 환류.
   **현재 코드 증거:** caller가 완성 JSON을 넣는 기존 경계와 별도로 source hash·PII fail-closed→structured
   generator→서로 결과를 공유하지 않는 red-team 2개→variant generator→독립 judge 3개 이상→durable
@@ -450,9 +488,22 @@
   공개 런타임 미접촉, 비밀 env 파기, helper 0·listener 0 복귀. 상세:
   [런북](./ops/nas-preview-g8-rollback-proof-runbook.md) ·
   [기계 판독 증거](./ops/evidence/nas-preview-g8-actual-rollback-2026-08-07.json).
-- [x] current source exact SHA `6030a677…c611`을 격리 NAS에 승격했다. release-only patch 3회 결정성,
-  전체 browser E2E 108/108, postdeploy SSE→DB review 32.437s, health 3/3, OpenAPI 126·auth 401·G0~G8
-  route, named DB volume 보존을 확인했다. 이는 runtime promotion 증거이며 실제 rollback receipt와 구분한다.
+- [x] 2026-08-07 release-only SHA `6030a677…c611`을 격리 NAS에 승격했다. patch 3회 결정성,
+  localhost candidate browser E2E 108/108, postdeploy SSE→DB review 32.437s, health 3/3,
+  OpenAPI 126·auth 401·G0~G8 route, named DB volume 보존을 확인했다. 이는 당시 runtime promotion
+  증거이며 현재 HEAD 배포 증거가 아니다.
+- [x] **clean-head release mode** — 명시적 `--source-mode clean-head`와 별도 detached source root를 추가했다.
+  tracked-dirty 차단, exact HEAD/tree/archive SHA, 2회 결정성, archive-only candidate, patch-mode 무회귀,
+  증거 binding, source-only insecure-context 6/6 gate, commit 전 NAS-origin 11-spec rollback gate를 unit
+  30/30·Ruff·py_compile로 고정했다. 첫 execute는 archive CRLF를 candidate에서 정규화하도록 fail-closed했고,
+  두 번째 execute는 API/types/build 뒤 109/5에서 fail-closed해 둘 다 NAS mutation 0이다.
+- [ ] **G8 NAS-origin 재검증** — `randomUuid()` 수정과 insecure-origin 6/6 회귀를 포함한 current HEAD를
+  위 clean-head mode로 격리 NAS preview에 배포한다. `started_at`의 9시간 오차 P0는 UTC `+00:00`, KST 달력 날짜,
+  KST browser focused 실DB E2E로 수정했고 API 전체 921 passed와 코칭 이력 1/1을 통과했다. 시간종료 모달 강제
+  닫기 우회는 없다. 사용자 승인 아래 새 clean commit·HEAD/tree/archive를 결속해 실제
+  `http://100.116.83.60:8088` origin에서 전체 회기
+  E2E 0 failure·SSE→DB review·student returned-practice desktop/mobile을 다시 검증하기 전에는 G8 전체를 DONE으로
+  올리지 않는다.
 
 ### I-DAG. 첫 에이전트 실행팩 AOS-001~012
 
@@ -475,7 +526,6 @@
 납품(공개 데모)의 핵심 블로커는 **A(공개 `/turn` proof + 배포 secrets)**. 그 다음이 **B(한신대 거버넌스)**와
 **C(Phase 3 파일럿)** — C는 2026-07-13 회의로 **7월 말~8월 초 파일럿 일정 확정**, 그 전제로 **H의 P1(회기 종료 시간 기반)**이
 새 구현 게이트다. **I(Outcome & Alliance OS)는 현재 감사 기준 G0~G6이 internal DONE이다.
-G8은 receipt-bound 실제 NAS rollback proof가 남았다. G7은 내부 구현 DONE과 외부 proof GATE를 분리하며,
-Deepgram live·auth public WSS·명시 동의 mic·
-50분 soak·독립 라벨 benchmark·운영 resource high-water가 남았다.** D~G는
+G8 receipt-bound 실제 NAS rollback은 완료됐고 UUID 수정 배포·NAS-origin 회기 재검증이 남았다. G7은 내부 구현 DONE과 외부 proof GATE를 분리하며,
+current source 공개 배포·`local_whisper`/`melotts` ready·auth public WSS·명시 동의 mic·50분 soak·독립 라벨 benchmark·운영 resource high-water가 남았다.** D~G는
 품질·확장 작업으로 게이트가 아니다. 상세 상태·검증 증거는 SSOT 대시보드가 소유한다.
diff --git a/docs/decisions/local-voice-stack.md b/docs/decisions/local-voice-stack.md
index 74f1c91..3c945b8 100644
--- a/docs/decisions/local-voice-stack.md
+++ b/docs/decisions/local-voice-stack.md
@@ -71,6 +71,18 @@ P1 프리셋 한정이었던 이유(권리 안전한 synthetic reference 를 P1
 - `scripts/melotts-server.py` — loopback HTTP 사이드카(`/health`, `POST /tts` → WAV).
   `VIGNETTE_VOICE_TTS_PROVIDER=melotts` + `VIGNETTE_MELOTTS_TTS_URL` 설정.
   실행: `scripts/start-melotts.ps1`.
+- 공개 런처 `scripts/start-public-runtime.ps1`은 현재 CPU 운영값인
+  `local_whisper/small/cpu-int8`(9882)과 `melotts/melotts-korean`(9883)을 직접 소유한다.
+  `scripts/probe-public-voice-sidecars.py`가 Whisper의 첫 WebSocket `ready` 프레임과 MeloTTS
+  `/health`의 provider/model/license/reference metadata를 정확히 검증한다. 기존 포트 리스너가 있어도
+  이 계약을 통과하지 않으면 임의 종료·재사용하지 않고 API 재시작 전에 fail-closed한다.
+- 공개 API는 같은 provider/model을 `/voice/health`로 다시 증명해야 기존 프로세스를 유지한다. 새 Uvicorn은
+  `--ws websockets --ws-max-queue 4`로 고정한다. 이 항목은 런처 소스 계약이며, 실제 공개 적용 완료 증거는
+  authenticated WSS·동의 기반 50분 soak·동시간 topology/runtime 증거가 모두 통과한 뒤 G7 pack에 남긴다.
+- G7 실제 증거 승격은 `-RequireFreshPublicProvenance`로 detached-clean commit/tree와 Python/cloudflared/config SHA를
+  mutation 전에 검증한다. legacy API와 exact-config cloudflared를 bounded 교체한 뒤 새 PID/start/executable·command
+  SHA/실제 cwd의 safe receipt를 남기며 raw command line·config contents는 저장하지 않는다. runner는 최소 3,120초를
+  캡처하고 voice/runtime/topology 공통 3,000초를 canonical checker와 결속한다.
 
 ## 실측 증거 (2026-08-08)
 
diff --git a/docs/dev_dashboard.html b/docs/dev_dashboard.html
index 002df86..a7a53a6 100644
--- a/docs/dev_dashboard.html
+++ b/docs/dev_dashboard.html
@@ -46,10 +46,16 @@
     section.block{margin-top:34px;scroll-margin-top:76px;}
     /* PULSE / hero */
     .pulse{display:grid;grid-template-columns:minmax(0,1.05fr) minmax(330px,.95fr);gap:22px;align-items:stretch;margin-top:22px;}
-    .pulse-main{background:var(--surface);border:1px solid var(--hair);border-radius:16px;padding:22px 24px;box-shadow:0 1px 2px rgba(28,42,42,.05);}
+    .pulse-main{min-width:0;background:var(--surface);border:1px solid var(--hair);border-radius:16px;padding:22px 24px;box-shadow:0 1px 2px rgba(28,42,42,.05);}
     .pulse-main h1{margin-top:9px;}
     .pulse-state{margin:13px 0 0;color:var(--ink-2);font-size:13.5px;max-width:640px;}
     .pulse-state b{color:var(--ink);}
+    .pulse-details{max-width:640px;margin-top:12px;border-top:1px solid var(--hair);}
+    .pulse-details summary{display:flex;align-items:center;min-height:40px;color:var(--accent-deep);font-size:12.5px;font-weight:750;cursor:pointer;list-style:none;}
+    .pulse-details summary::-webkit-details-marker{display:none;}
+    .pulse-details summary:after{content:"＋";margin-left:auto;color:var(--ink-3);font:700 14px/1 var(--mono);}
+    .pulse-details[open] summary:after{content:"−";}
+    .pulse-details .pulse-state{margin:0;padding:2px 0 4px;font-size:12.5px;line-height:1.6;}
     .phase-rail{display:grid;grid-template-columns:repeat(6,1fr);gap:7px;margin-top:18px;}
     .pr-seg{position:relative;}
     .pr-bar{height:7px;border-radius:999px;background:var(--paper-3);overflow:hidden;}
@@ -78,7 +84,7 @@
     .kpi-badge{position:absolute;right:13px;top:12px;display:none;align-items:center;gap:5px;font:800 10px/1 var(--mono);letter-spacing:.02em;color:#fff;background:var(--crit);padding:5px 8px;border-radius:7px;box-shadow:0 1px 3px rgba(168,53,44,.35);}
     .kpi.k-plan{border-color:color-mix(in srgb,var(--crit) 18%,var(--hair));}
     /* metric strip */
-    .mstrip{display:flex;flex-wrap:wrap;gap:8px;margin-top:16px;}
+    .mstrip{display:flex;flex-wrap:wrap;min-width:0;max-width:100%;gap:8px;margin-top:16px;}
     .mchip{display:inline-flex;align-items:center;gap:7px;padding:6px 11px;border:1px solid var(--hair);border-radius:999px;background:var(--paper);font-size:11.5px;color:var(--ink-2);}
     .mchip b{font:700 12px/1 var(--mono);color:var(--ink);}
     .mchip.good b{color:var(--pos);}
@@ -262,6 +268,9 @@
       .task-row,.task-row.r3{grid-template-columns:1fr;}
       .task-row>div{border-bottom:1px solid var(--hair);} .task-row>div:last-child{border-bottom:0;}
       .brand small{display:none;}
+      .owner-pill,.fbtn,.tab-button,.dg-link,.pulse-details summary{min-height:44px;}
+      .mstrip{flex-wrap:nowrap;overflow-x:auto;padding-bottom:4px;scrollbar-width:thin;}
+      .mchip{flex:0 0 auto;}
     }
     @media (max-width:460px){ .kpis{grid-template-columns:1fr;} h1{font-size:22px;} .stamp{display:none;} }
     @media (prefers-reduced-motion:reduce){ *{transition:none!important;} }
@@ -272,7 +281,7 @@
     <div class="brand"><span class="mark" aria-hidden="true"></span><span>Vignette 커맨드센터<small>팀장 리뷰 · dev status</small></span></div>
     <div class="head-right">
       <a class="owner-pill" href="#owner"><span class="d" aria-hidden="true"></span>내 차례 <b id="pill-owner">0</b></a>
-      <span class="stamp">2026-08-07 KST</span>
+      <span class="stamp">2026-08-09 KST</span>
     </div>
   </header>
 
@@ -281,12 +290,16 @@
     <section class="pulse">
       <div class="pulse-main">
         <span class="eyebrow">project pulse</span>
-        <h1>지금 위치: <em>Phase 0 제품 데모는 public /turn proof가 핵심 블로커</em>.<br><em>Phase 1 MVP 코어 루프</em>는 로컬 DB-backed 실증 완료.</h1>
-        <p class="pulse-state"><b>긴급 운영 상태:</b> 2026-08-07 18:26 KST 공개 DB를 복구 named volume으로 전환했다. public owner 집계 users 84·sessions 30·turns 705, Google 계정 16·소유 회기 30, orphan 0이며 health·engine·OAuth·로그인 화면·watchdog가 정상이다. 보안상 기존 auth session은 복사하지 않아 모든 사용자는 Google 재로그인이 필요하고, 전환 직전 container·dump와 원본 volume은 삭제하지 않았다. <b>개발 상태:</b> G0 provenance census 29/29·위반 0과 G6 safety metadata-only 우선 runtime은 disposable clone에서 통과했다. G4·G5 실제 API/DB/browser 폐루프와 current exact SHA <code>6030a677…c611</code>의 NAS 승격은 완료됐고 전체 browser E2E 108/108·postdeploy SSE→DB review·health 3/3·OpenAPI 126을 통과했다. G8은 격리 NAS에서 실제 image rollback 2회를 executed receipt(<code>nas-g8-723eeef2…</code>/<code>nas-g8-2738846c…</code>)로 실행해 DONE이며, G7은 Deepgram live·인증 WSS·명시 동의 물리 마이크 50분·독립 라벨 voice-gain과 resource high-water 전까지 외부 GATE다.</p>
+        <h1>지금 위치: <em>G0~G6 internal DONE</em>.<br><em>G8 runtime 재검증</em>과 <em>G7 external proof</em>를 닫는 중.</h1>
+        <p class="pulse-state"><b>현재:</b> 18:02 KST Docker Desktop UI의 직접 DB stop을 같은 container·recovered named volume 재시작으로 복구했고 public DB·engine은 다시 정상이다. rollback receipt 2건도 보존했다. current fixture는 불변 110 + 최신 dashboard 10 분할 GREEN이고 자기주도 desktop/mobile 6/6을 재확인했다. <b>다음:</b> clean commit에서 exact 120 재실행 → NAS-origin 0 failure → G7 공개 음성·물리 마이크·독립 사람 증거 순서로 진행한다.</p>
+        <details class="pulse-details">
+          <summary>운영 복구·watchdog·배포 상세 보기</summary>
+                  <p class="pulse-state">2026-08-07 18:26 KST 공개 DB를 <code>vignette_recovered_prod_20260807</code> named volume으로 전환했고 원본 container·dump·volume은 삭제하지 않았다. 기존 auth session은 복사하지 않아 사용자는 Google 재로그인이 필요하다. 2026-08-09 18:02:55 KST Docker Desktop UI가 active DB container에 직접 stop을 보내 public <code>db=false</code>가 재발했지만 같은 container ID와 recovered volume만 18:05 KST 재시작했다. 재기동 뒤 owner read-only 집계는 users 356·sessions 193·turns 726, Google users 16·Google-owned sessions 31이고 public health는 다시 <code>status=ok·db=true·engine=true</code>다. public task source pin 코드는 완료됐다. watchdog·로그온 boot는 detached clean release와 exact Git commit/tree·watchdog|boot/start SHA가 없으면 health·Docker·process mutation 전에 실패하고 hidden VBS도 pinned task만 trigger한다(provenance 11개 포함 combined 22/22, PS5.1·WSH PASS). 다만 실제 두 Scheduled Task action은 아직 shared worktree라 watchdog은 필수 pin 인자 부재로 <code>LastTaskResult=1</code>이며 자동복구가 의도적으로 fail-closed다. clean commit 뒤 두 task를 동일 stable release root로 재등록하고 action pin·result 0·로그온/reboot smoke를 확인해야 한다. G8 NAS SHA <code>6030a677…c611</code>은 localhost candidate와 SSE→DB review는 통과했지만 평문 origin UUID 결함 빌드이므로 current clean source 재배포가 필요하다. G7 source는 runner/checker/topology 86/86, launcher/sidecar 80/80, 통합 166/166, API voice 71/71이지만 public은 아직 OpenAI provider·Git 없는 냉동 release라 external GATE다.</p>
+        </details>
         <div class="phase-rail" id="phase-rail" aria-label="Phase 진행 추정"></div>
         <div class="mstrip" aria-label="검증 지표">
-          <span class="mchip warn">Full E2E 현재 수집 <b>604</b> · 전체 GREEN 대기</span>
-          <span class="mchip good">현재 전체 회귀 · gateway <b>58</b> · backend <b>898</b></span>
+          <span class="mchip warn">Fixture E2E <b>110 + dashboard 10 분할 GREEN</b> · clean HEAD 120/120 대기</span>
+          <span class="mchip good">현재 전체 회귀 · gateway <b>58</b> · backend <b>921</b></span>
           <span class="mchip good">Outcome clean E2E <b>126</b> · visual <b>15/15</b></span>
           <span class="mchip good">Alliance G1 baseline 1.2 <b>9/9</b> · 내부 DONE</span>
           <span class="mchip">Tailnet <b>이전 확인 OK</b></span>
@@ -637,6 +650,11 @@
         <p class="dg-note">182차 적용(2026-08-08): <b>회기 전 자기점검(pre alliance gate) 화면을 데스크톱·모바일 전 폭에서 다시 짰다.</b> 계측이 먼저였다. gate 상태에서 카드가 <code>align-self:stretch</code> + <code>grid-template-rows: auto minmax(0,1fr) auto auto</code>인데 base flex의 <code>align-items:center</code>가 살아 있어 3축 블록이 1fr 행 한가운데 떠 있었다. 1920×1080 기준 카드의 <b>66.5%가 빈 공간</b>이고 축 위·아래로 각각 <code>277px</code>의 죽은 여백이 생겼다. 척도 라벨은 <code>0.54rem</code>+<code>nowrap</code>+ellipsis라 901~1279px에서 최대 <b>12개가 "전허 아…"</b>로 잘렸고, ≤620px에서는 <code>display:none</code>으로 <b>15개 전부 사라져</b> 숫자 1~5만 남았다. 320×568에서는 <code>@media (max-width:420px) and (max-height:620px)</code>의 collapsed 전용 <code>40px</code> 고정 행이 gate에도 걸려 카드가 <b>40px로 눌리고 헤더와 축이 겹쳐</b> 화면이 사실상 깨져 있었다. 수정은 네 가지다. (1) gate 카드는 행 높이만큼 늘리지 않고 <code>align-self:center</code>+<code>max-height:100%</code>+내부 스크롤로 화면 중앙에 서게 했다. (2) 3열 격자를 버리고 축마다 <b>질문 한 줄 + 전폭 5칸 척도</b> 세로 스택으로 바꿔 어느 폭에서도 라벨을 자르거나 숨기지 않는다(<code>word-break:keep-all</code>+<code>overflow-wrap:normal</code>로 어절 경계만 줄바꿈). (3) 정보가 없던 <code>3 AXES</code> 모노 배지를 제출 버튼이 왜 잠겨 있는지 답하는 <code>0/3 축 선택함</code> 진행 표시(<code>aria-live</code>)로 교체했다. (4) 40px 행 규칙에 <code>:not(.sx-alliance-gated)</code>를 걸어 collapsed mid 전용으로 되돌렸다. 선택 상태 글자색도 반투명 <code>--surface</code>에서 <code>--text-on-accent</code>로 고쳤다(라이트 4.85:1 · 다크 6.36:1, AA). 15개 뷰포트 재계측 결과 빈 공간 비율 <b>0.665→0.127</b>(1920), 라벨 잘림 <b>12→0</b>, 숨김 <b>15→0</b>, 최소 탭 타깃 <b>38×38→46×60</b>, 문서 가로 오버플로 전 구간 0이고, 320×568에서는 카드 내부 스크롤로 제출까지 도달해 실제 잠금·발화 입력 활성까지 확인했다. 인라인 mid 카드는 ≥1080px에서만 3열로 눕혀 축어록을 밀지 않게 두었고 높이는 오히려 <b>약 55px 줄었다</b>. 무회귀: <code>typecheck</code> 통과, <code>session-layout</code> <b>8/8</b>, <code>alliance-pulse</code> <b>8/8</b>, pre/mid 잠금 E2E <b>2/2</b>, <code>layout-visual-gate</code> 22/23(실패 1건 <code>settings</code>는 변경 전 baseline에서도 동일 실패로 확인된 기존 회귀). session-mvp 음성 4건 실패도 baseline 동일이라 이 변경과 무관하다.</p>
         <p class="dg-note">183차 적용(2026-08-08): 182차 뒤 소유자 스크린샷에서 <b>시간 만료 상태의 게이트 화면</b>이 여전히 깨져 있어 네 개의 별개 결함을 계측으로 특정하고 닫았다. (1) <code>.sx-timebar</code>는 세션이 다크 stage 팔레트를 강제하던 시절의 잔재로, 배경이 <b>어디에도 정의된 적 없는</b> <code>--bg-panel</code>의 하드코딩 다크 폴백으로 칠해지는데 글자만 테마 토큰을 따라가 라이트에서 제목 <b>1.13:1</b>·설명 <b>1.76:1</b>이었다. 의미색 토큰(<code>--warn-*</code>/<code>--crit-*</code>)으로 되돌려 <b>13.88:1</b>·<b>6.94:1</b>(다크 13.86·9.30)로 올렸다. (2) 같은 이유로 <code>.sx-end-dialog__panel</code>이 어두운 gradient 위 어두운 글자라 제목 <b>2.68:1</b>·본문 <b>1.14:1</b>로 사실상 보이지 않았다. 불투명 <code>--bg-app</code> 표면으로 바꿔 <b>15.79:1</b>·<b>5.19:1</b>(다크 15.18·6.52)이 됐다. (3) 보태니컬 장식 위로 본문을 올리는 <code>.sx-page--active &gt; *{position:relative}</code>가 같은 특이도(0,1,0)로 <b>뒤에 있어</b> 종료 모달의 <code>position:fixed</code>를 덮어썼다. 오버레이가 화면을 덮는 대신 그리드 한 칸(<code>1532×32px</code>)으로 눌려 들어갔다. <code>:not(.sx-end-dialog)</code>로 제외해 <code>fixed</code> <b>1600×900 뷰포트 전체</b>를 회복했다. (4) 게이트 행 정의 <code>.sx-page--active.sx-alliance-gated</code>(0,2,0)가 <code>:has()</code> 두 개짜리 규칙(0,3,0)보다 특이도가 낮아 <b>시간 만료 바가 뜨는 순간 밀려났다</b>. 숨긴 축어록·컨트롤바의 빈 트랙이 남아 화면 절반이 비었다(<code>80px 59px 628px 0px 116px</code> 5행). 게이트 규칙에도 같은 <code>:has()</code>를 붙여 <b>3행</b>(<code>80px 59px 693px</code>)으로 정정했다. 무회귀: <code>typecheck</code> 통과, <code>session-layout</code>+<code>alliance-pulse</code>+<code>layout-visual-gate</code> <b>31/31</b>(182차에서 실패했던 <code>settings</code>도 통과), 시간만료 종료 다이얼로그 E2E <b>2/2</b>, pre/mid 잠금 E2E <b>2/2</b>, <code>full-sweep-session</code>+<code>self-directed-learning-loop</code> 30 pass. 남은 음성 4건(<code>voice skip</code>·<code>Space mic</code>)은 변경분 stash 후 baseline에서도 동일 실패라 이 변경과 무관한 기존 회귀다.</p>
         <p class="dg-note">184차 적용(2026-08-08): 182·183차 변경이 <b>로컬 워크트리에만</b> 있어 소유자가 보던 공개 사이트에는 반영될 수 없던 상태를 배포로 닫았다. 소유자 스크린샷의 <code>3 AXES</code>는 이미 소스에서 사라진 문자열이었고, 접속 주소가 <code>https://vignette.chanpaca.net</code>이라 커밋 전 변경이 보일 수 없는 것이 원인이었다. 커밋 <code>f0c2240f</code>로 고정한 뒤 <code>npm run build</code>(Session 청크 <code>Session-DnhnKvTy.js</code>·<code>Session-Xn1JLv-d.css</code>), <code>scripts\preserve-pages-assets.ps1</code>로 직전 5개 production 배포의 지연 로드 자산 <b>104개</b>를 보존하고(진행 중 세션의 lazy chunk 404 방지), <code>wrangler pages deploy dist --project-name vignette --branch main --commit-hash f0c2240f</code>로 배포했다(deployment <code>a12c195c</code>, 신규 업로드 37 / 기존 666). 커스텀 도메인 검증은 <code>index-BTkJUPLZ.js</code> 200, Session JS/CSS 모두 올바른 MIME 200이며 <b>신규 마커</b>(<code>축 선택함</code>·<code>is-gate</code>·<code>:not(.sx-end-dialog)</code>) 각 1건, <b>구버전 마커</b>(<code>3 AXES</code>·<code>--bg-panel</code>·척도 <code>text-overflow</code>) 전부 0건이다. 첫 조회에서 edge가 이전 index를 준 건 배포 직후 타이밍이었고 재조회에서 신규 index로 확정됐다. 공개 API·런타임은 건드리지 않았다.</p>
+        <p class="dg-note">185차 적용(2026-08-09): 177·181차의 G8 DONE 판정은 <b>rollback receipt gate 완료</b>로 범위를 정정했다. 108/108은 localhost candidate 결과였고 같은 NAS 평문 origin에서는 secure-context 전용 <code>crypto.randomUUID</code> 예외로 회기 E2E 24건이 실패했다. 소스는 <code>randomUuid()</code>로 통일해 insecure-origin 6/6·API type·typecheck·build를 통과했지만 NAS에는 아직 미배포다. 따라서 G8 카드는 <b>BUILD · RECEIPT DONE · RUNTIME REVALIDATION</b>으로 되돌리고, clean-head release mode 구현→수정 배포→실제 NAS-origin 전체 회기 E2E GREEN까지를 남긴다. G7은 운영 기본 <code>local_whisper</code>/<code>melotts</code>의 current 공개 배포·인증 WSS·명시 동의 mic 50분·동시 runtime/topology·독립 human pack 전까지 외부 GATE다.</p>
+        <p class="dg-note">186차 적용(2026-08-09): 공개 DB listener 소실 사고는 Docker Desktop 중단으로 좁혀졌고 recovered named volume을 보존한 기존 컨테이너만 재기동해 복구했다. public/local health는 db·engine true, current owner 집계는 users 171·sessions 93·turns 726이다. 당시 워치독 action의 삭제된 옛 workspace 드리프트를 shared current workspace·5분 주기로 교정하고 즉시 실행 0을 확인했다. 이 임시 조치는 후속 source-pin에서 안전하지 않은 입력으로 판정됐고, 현재 task는 detached-clean pin 인자 부재로 mutation 전에 fail-closed한다. G8 clean-head release mode는 tracked-dirty 차단·HEAD/tree/archive 2회 결정성·archive-only candidate·patch 무회귀·evidence binding과 commit 전 NAS-origin 11-spec rollback gate를 unit 30/30으로 고정했고, 새 NAS preview predeploy dump <code>72698232…5d41c</code>(1,015,222 bytes·TOC 1,752)를 보존했다. G7 재감사에서는 공개 OpenAPI 119·<code>/admin/voice-runtime</code> 부재, OpenAI voice provider, local sidecar listener 0, Windows host topology와 Compose-only collector 불일치를 확인했으므로 사람 증거 전에 launcher·topology 선행 구현이 필요하다.</p>
+        <p class="dg-note">187차 적용(2026-08-09): G8 clean-head dry-run은 active <code>6030a677…c611</code>→desired archive <code>6b1b15bd…a3f7</code>를 mutation 0으로 결속했다. execute 1은 archive CRLF/API type byte-check에서, execute 2는 API·types·build 통과 뒤 session E2E <code>109 passed / 5 failed</code>에서 모두 승격 전에 fail-closed되어 NAS active/image/DB는 바뀌지 않았다. source-only UUID 4건은 production 번들에서 <code>/src/lib/uuid.ts</code> import가 불가능한 gate 배치 오류라 별도 Vite gate 6/6으로 분리했다. 남은 실제 제품 blocker는 timezone 없는 <code>started_at</code>을 KST 브라우저가 약 9시간 경과로 오인해 시간종료 모달이 정상 코칭 이력을 가리는 문제다. backend UTC offset/Z 계약과 focused disposable DB/browser 회귀를 닫고 새 clean commit을 만든 뒤에만 NAS 배포를 재개한다.</p>
+        <p class="dg-note">188차 적용(2026-08-09): 회기 시간 P0를 우회 없이 수정했다. browser-facing <code>started_at</code>/<code>ended_at</code>과 learner/teacher dashboard timestamp는 UTC <code>+00:00</code>을 반환하고, 리뷰의 달력 날짜는 서버 locale 대신 KST(+09:00)를 사용한다. backend 관련 65 passed, 후속 voice 계약을 포함한 API 전체 921 passed, Ruff·compile·web typecheck를 통과했다. 고유 Compose DB/API/Web/engine과 <code>Asia/Seoul</code> browser에서 코칭 이력 focused 1/1은 active/null·UTC suffix·10분 미만 경과·timebar/dialog 0·reload 후 coach mark 실제 클릭과 source-pack dialog를 확인했다. 종료 뒤 container·volume·listener 0이다. 이제 새 clean commit 결속과 NAS-origin 전체 E2E가 남았다.</p>
+        <p class="dg-note">189차 적용(2026-08-09): G7 외부 실행 전 P0를 소스에서 닫았다. production runner exit 0은 canonical checker 0·<code>gate_closed=true</code>에 결속하고, browser Origin allowlist를 API/WSS/admin/topology transport host·scheme과 분리했다. capture는 최소 3,120초·ceil+terminal sample이며 checker는 voice/runtime/topology 공통 교집합 3,000초를 강제한다. Windows 증거는 detached-clean commit/tree, runner/collector/checker SHA, <code>psutil==6.1.1</code>을 매 sample 전후 검증한다. fresh public launcher는 mutation 전에 source·Python·cloudflared·config SHA를 고정하고, legacy API와 exact-config cloudflared를 bounded 교체해 새 PID/start/exe·command SHA/실제 cwd의 raw command-line 없는 receipt를 남긴다. receipt destination은 runtime mutation 전에 create/flush/atomic-replace 권한을 검사하고 기존 receipt를 보존한 채 원자 게시한다. 검증: G7 runner/checker/topology 86/86, launcher/sidecar 80/80, 통합 166/166, API 921, gateway 58, Web api-types·typecheck·build, 자기주도 desktop/mobile 6/6, Ruff·compile·PS5.1 parser·diff-check PASS. 실제 public 실행·마이크·사람 평가는 하지 않았으므로 G7은 external GATE다.</p>
         <div class="dg-principles" aria-label="디자인 생성 가드레일">
           <div><b>래스터만 사용</b><span>이미지 생성 도구 산출물은 PNG 기반 시안이다. SVG·벡터·와이어프레임·로고 시트로 해석하지 않는다.</span></div>
           <div><b>기능 우선</b><span>메인 라우트의 실제 액션과 정보 구조를 먼저 반영한다. 장식은 기능을 가리지 않는 수준에서만 쓴다.</span></div>
@@ -819,8 +837,8 @@
         <div class="tg-head"><h3>코드품질 · 로컬 개발 스택</h3><span class="tg-note">리팩토링 연구 + 1-커맨드 dev 스택 (2026-06-26~27). code-quality-research-2026-06-26.md · local-development.md</span></div>
         <div class="scards">
           <article class="scard" data-status="doing" data-cat="인프라·스택·RAG" data-owner="0">
-            <button class="scard-head" aria-expanded="false"><span class="chip c-doing">DB RECOVERY · PUBLIC LIVE</span><span class="scard-mid"><span class="scard-title">공개 계정·회기 복구와 무손실 전환</span><span class="scard-sum">복구 named volume을 공개 55432에 전환했다. 데이터·auth·watchdog는 정상이며 사용자 재로그인 후 과거 소유 회기 확인만 남았다.</span></span><span class="caret" aria-hidden="true"></span></button>
-            <div class="scard-body"><div class="kv k-good"><b>공개 전환</b><p>2026-08-07 18:26 KST owner 승인으로 <code>vignette_recovered_prod_20260807</code>을 <code>vignette-dev-db:55432</code>에 연결했다. public owner 집계 users 84·sessions 30·turns 705, Google 계정 16·소유 회기 30, orphan 0이다. local/public health는 prod·DB true·engine true·claude_cli, OpenAPI 119, Google OAuth 302, 공개 로그인 화면 렌더와 watchdog check-only를 통과했다.</p></div><div class="kv"><b>보존·rollback</b><p>전환 직전 DB는 <code>vignette-dev-db-pre-recovery-20260807-182642</code>로 중지 보존했고 exact dump SHA는 <code>6b84d5c8…8af1f</code>다. 원본 volume, post-merge dump <code>d24eaa75…2e32</code>, 최종 recovered dump <code>d7bcc396…68ed</code>, 자동 rollback을 실증한 실패 후보 2개도 삭제하지 않았다.</p></div><div class="kv k-warn"><b>사용자 확인</b><p>보안상 기존 <code>auth_session</code>은 복사하지 않아 모두 Google 재로그인이 필요하다. 계정·회기 원장은 복구돼 있다. 실제 사용자가 재로그인한 뒤 과거 소유 회기 목록이 보이는지 확인할 때까지 이 카드는 안정화 중으로 유지한다. 상세: <code>ops/public-db-recovery-rehearsal-2026-08-07.md</code>.</p></div></div>
+            <button class="scard-head" aria-expanded="false"><span class="chip c-doing">DB RECOVERY · PUBLIC LIVE</span><span class="scard-mid"><span class="scard-title">공개 계정·회기 복구와 무손실 전환</span><span class="scard-sum">복구 named volume을 공개 55432에 전환했다. 데이터·auth·public health는 정상이고 task 자동복구는 stable-source 재등록을 기다린다.</span></span><span class="caret" aria-hidden="true"></span></button>
+            <div class="scard-body"><div class="kv k-good"><b>공개 전환</b><p>2026-08-07 18:26 KST owner 승인으로 <code>vignette_recovered_prod_20260807</code>을 <code>vignette-dev-db:55432</code>에 연결했다. cutover 집계 users 84·sessions 30·turns 705, Google 계정 16·소유 회기 30, orphan 0이다. 2026-08-09 Docker Desktop 중단 후 동일 컨테이너만 재기동했으며 현재 users 171·sessions 93·turns 726, local/public health prod·DB true·engine true·claude_cli, OpenAPI 119, Google OAuth 302다. source-pin 코드는 완료됐지만 실제 watchdog·로그온 task action은 shared worktree라 최신 watchdog은 pin 인자 부재로 mutation 전에 exit 1이다. clean commit의 detached stable release root로 두 task를 재등록하기 전까지 자동복구는 의도적으로 fail-closed다.</p></div><div class="kv"><b>보존·rollback</b><p>전환 직전 DB는 <code>vignette-dev-db-pre-recovery-20260807-182642</code>로 중지 보존했고 exact dump SHA는 <code>6b84d5c8…8af1f</code>다. 원본 volume, post-merge dump <code>d24eaa75…2e32</code>, 최종 recovered dump <code>d7bcc396…68ed</code>, 자동 rollback을 실증한 실패 후보 2개도 삭제하지 않았다.</p></div><div class="kv k-warn"><b>사용자 확인</b><p>보안상 기존 <code>auth_session</code>은 복사하지 않아 모두 Google 재로그인이 필요하다. 계정·회기 원장은 복구돼 있다. 실제 사용자가 재로그인한 뒤 과거 소유 회기 목록이 보이는지 확인할 때까지 이 카드는 안정화 중으로 유지한다. 상세: <code>ops/public-db-recovery-rehearsal-2026-08-07.md</code>.</p></div></div>
           </article>
           <article class="scard" data-status="done" data-cat="인프라·스택·RAG" data-owner="0">
             <button class="scard-head" aria-expanded="false"><span class="chip c-done">DEV STACK · DB 보존 패치</span><span class="scard-mid"><span class="scard-title">로컬 개발 스택 1-커맨드 기동 — <code>scripts/dev-up.ps1</code></span><span class="scard-sum">정지 DB는 start 우선, 신규 PGDATA는 고정 named volume, 일반 dev-up의 DB 삭제 경로는 0.</span></span><span class="caret" aria-hidden="true"></span></button>
@@ -866,8 +884,8 @@
              <div class="scard-body"><div class="kv"><b>구현</b><p><code>app.measurement_event</code>·<code>app.measurement_instrument</code>·<code>audit.model_run</code>과 6종 provenance, Python→JSON Schema→TypeScript 계약, 기존 rapport/alliance/fast/deep/Phase 3 adapter, 혼합층 집계 차단, 8개 deterministic benchmark 장면을 구축했다. <b>AOS-001~004 완료</b>.</p></div><div class="kv k-good"><b>종료 증거</b><p>post-merge dump disposable clone에 migrations 14/15/16을 각각 두 번 원자 재적용했다. current source census는 producer 29/29, unknown/missing table·null instrument/source/perspective·orphan instrument/model-run/evidence·호환성 위반 0이다. 기존 계약/schema·live append-only/RLS 증거도 유지한다. 상세: <code>ops/evidence/g0-provenance-census-scratch-post-g6-g8-20260807.json</code>, <code>ops/evidence/measurement-migration-rehearsal-2026-08-07.json</code>.</p></div></div>
           </article>
           <article class="scard" data-status="done" data-cat="Outcome OS·동맹" data-owner="0">
-            <button class="scard-head" aria-expanded="false"><span class="chip c-done">G1 DONE · EXTERNAL ICC 분리</span><span class="scard-mid"><span class="scard-title">Alliance Core — goal/task/bond 다관점 측정</span><span class="scard-sum">승격 prompt 1.2는 24/24 ready·방향 9/9·오류 0으로 재검증했고 human-AI ICC는 외부 파일럿 품질 목표로 분리한다.</span></span><span class="caret" aria-hidden="true"></span></button>
-             <div class="scard-body"><div class="kv"><b>구현</b><p>회기 pulse, legacy alliance 격리, 자기평가 선잠금, 독립 모델 실행·재시도, 학습자 관점차 리뷰, 교수자 append-only 재평가를 구축했다. 실제 Session은 첫 발화 전 pre를 fail-closed로 잠그고 첫 왕복 뒤 흐름을 막지 않는 mid 30초 점검을 제공한다. <b>AOS-005~010 완료</b>.</p></div><div class="kv k-good"><b>종료 증거</b><p>focused backend 43 passed, live PostgreSQL reveal/RLS/audit/supersession smoke, desktop/mobile Alliance Pulse 6/6와 기존 회기 리뷰 12/12 통과. 동일 payload stable ID, 변경 payload 409, 타 학습자·교차 cohort 404와 pre/mid desktop·mobile 2/2·고정 캡처 4장을 추가 검증했다. 최신 source API/dev DB는 한 회기의 <code>pre(degraded/insufficient_transcript) → mid(ready) → post(ready)</code>를 실제 turn UUID·ended_at으로 닫고, awaiting 응답의 external-event read skew와 degraded terminal DB 제약을 교정했다. prompt 1.2.0 합성 gold 방향 정확도 9/9, 최종 실패 0, 근거 recall 88.9%. 상세: <code>ops/evidence/alliance-pulse-pre-mid-post-live-2026-08-07.json</code>, <code>ops/outcome-os-g1-g4-g5-g7-self-directed-integration-evidence-2026-08-07.md</code>.</p></div></div>
+            <button class="scard-head" aria-expanded="false"><span class="chip c-done">G1 DONE · INTERNAL · EXTERNAL ICC 분리</span><span class="scard-mid"><span class="scard-title">Alliance Core — goal/task/bond 다관점 측정</span><span class="scard-sum">승격 prompt 1.2는 24/24 ready·방향 9/9·오류 0으로 재검증했고 human-AI ICC는 외부 파일럿 품질 목표로 분리한다.</span></span><span class="caret" aria-hidden="true"></span></button>
+             <div class="scard-body"><div class="kv"><b>구현</b><p>회기 pulse, legacy alliance 격리, 자기평가 선잠금, 독립 모델 실행·재시도, 학습자 관점차 리뷰, 교수자 append-only 재평가를 구축했다. 실제 Session은 첫 발화 전 pre를 fail-closed로 잠그고 첫 왕복 뒤 흐름을 막지 않는 mid 30초 점검을 제공한다. <b>AOS-005~010 완료</b>.</p></div><div class="kv k-good"><b>종료 증거</b><p>focused backend 43 passed, live PostgreSQL reveal/RLS/audit/supersession smoke, desktop/mobile Alliance Pulse 6/6와 기존 회기 리뷰 12/12 통과. 동일 payload stable ID, 변경 payload 409, 타 학습자·교차 cohort 404와 pre/mid desktop·mobile 2/2·고정 캡처 4장을 추가 검증했다. 최신 source API/dev DB는 한 회기의 <code>pre(degraded/insufficient_transcript) → mid(ready) → post(ready)</code>를 실제 turn UUID·ended_at으로 닫고, awaiting 응답의 external-event read skew와 degraded terminal DB 제약을 교정했다. prompt 1.2.0 read-skew 재검증은 prediction 24/24 ready·비교 대상 9/9·방향 9/9·오류 0, 근거 recall 94.4%·precision 73.9%다. 상세: <code>ops/evidence/alliance-calibration-comparison-prompt-1.2.0-readskewfix-2026-08-07.json</code>, <code>ops/evidence/alliance-pulse-pre-mid-post-live-2026-08-07.json</code>.</p></div></div>
           </article>
           <article class="scard" data-status="done" data-cat="Outcome OS·종단" data-owner="0">
             <button class="scard-head" aria-expanded="false"><span class="chip c-done">G2 DONE · INTERNAL</span><span class="scard-mid"><span class="scard-title">Longitudinal Outcome Trajectory — 종단 성과 궤적</span><span class="scard-sum">5회기 예상 궤적·악화·관계 사건을 세 개 독립 축과 장면 근거로 조기에 추적한다.</span></span><span class="caret" aria-hidden="true"></span></button>
@@ -879,7 +897,7 @@
           </article>
           <article class="scard" data-status="done" data-cat="Outcome OS·수련" data-owner="0">
             <button class="scard-head" aria-expanded="false"><span class="chip c-done">G4 DONE · INTERNAL</span><span class="scard-mid"><span class="scard-title">Deliberate Practice Engine — 의도적 수련 엔진</span><span class="scard-sum">실제 API/DB/엔진과 route-mock 0 브라우저에서 처방→후속 회기→observer 폐루프를 닫았다.</span></span><span class="caret" aria-hidden="true"></span></button>
-             <div class="scard-body"><div class="kv"><b>구현</b><p>원자적 practice prescription, 5개 연습 모드, competency graph·attempt evidence, 약점/망각 우선 선택, append-only PostgreSQL/API·RLS·내부 토큰, 학습자/교수자 리뷰 UI를 연결했다. ready 회기말 평가 저장 뒤 production <code>session_learning_producer</code>가 durable turn intent deviation을 실제 처방으로 변환한다. 학습자 CTA는 처방·원본 회기·성공 기준을 학습 홈→시작 전 브리핑→실제 새 세션 URL까지 보존한다.</p></div><div class="kv k-good"><b>종료 증거</b><p>실제 API/DB/엔진 smoke는 prescriptions 2·episodes 6·attempts 6·append-only correction 1·ready observer model-run 2를 통과했다. post-merge disposable clone의 실제 브라우저는 route mock 0으로 desktop 2/2·mobile 2/2, returned 카드 우선·G4 POST·read-model reload·before/after·멱등 retry를 확인했고 최종 episode/attempt/ready observer 각 1, 중복·UUID 노출·마이크 호출·overflow 0이다. 전체 API 현재 898 passed. 상세: <code>ops/evidence/scratch-browser-returned-practice-closed-loop-evidence-20260807.json</code>, <code>ops/outcome-os-g4-g5-production-caller-evidence-2026-08-07.md</code>.</p></div></div>
+              <div class="scard-body"><div class="kv"><b>구현</b><p>원자적 practice prescription, 5개 연습 모드, competency graph·attempt evidence, 약점/망각 우선 선택, append-only PostgreSQL/API·RLS·내부 토큰, 학습자/교수자 리뷰 UI를 연결했다. ready 회기말 평가 저장 뒤 production <code>session_learning_producer</code>가 durable turn intent deviation을 실제 처방으로 변환한다. 학습자 CTA는 처방·원본 회기·성공 기준을 학습 홈→시작 전 브리핑→실제 새 세션 URL까지 보존한다.</p></div><div class="kv k-good"><b>종료 증거</b><p>실제 API/DB/엔진 smoke는 prescriptions 2·episodes 6·attempts 6·append-only correction 1·ready observer model-run 2를 통과했다. post-merge disposable clone의 실제 브라우저는 route mock 0으로 desktop 2/2·mobile 2/2, returned 카드 우선·G4 POST·read-model reload·before/after·멱등 retry를 확인했고 최종 episode/attempt/ready observer 각 1, 중복·UUID 노출·마이크 호출·overflow 0이다. 전체 API 현재 921 passed. 상세: <code>ops/evidence/scratch-browser-returned-practice-closed-loop-evidence-20260807.json</code>, <code>ops/outcome-os-g4-g5-production-caller-evidence-2026-08-07.md</code>.</p></div></div>
           </article>
           <article class="scard" data-status="done" data-cat="Outcome OS·보정" data-owner="0">
             <button class="scard-head" aria-expanded="false"><span class="chip c-done">G5 DONE · INTERNAL</span><span class="scard-mid"><span class="scard-title">Calibration Mirror &amp; Transfer — 자기보정과 전이</span><span class="scard-sum">학생 actual execution을 실제 API/DB/엔진과 브라우저에서 독립 observer·provenance까지 닫았다.</span></span><span class="caret" aria-hidden="true"></span></button>
@@ -890,12 +908,12 @@
             <div class="scard-body"><div class="kv"><b>구현</b><p>append-only attention queue·원장 pointer, metadata-only 교수자/AI 불일치 dataset·audit, cohort gap, version/subgroup drift, 4-domain Phase 3 manifest와 역할 안전 교수자·연구 UX를 연결했다. scheduled producer가 G0~G5 실제 원장에서 attention/gap을 파생하고 repo-approved synthetic version comparison을 별도 research 트랜잭션으로 실행한다.</p></div><div class="kv k-good"><b>종료 증거</b><p>기존 6-signal queue·3-click·네 도메인 manifest·실제 API/DB/RLS/audit·version/subgroup 증거에 더해 post-merge disposable clone의 current source에서 safety event와 deterioration 경쟁 신호를 실제 derive했다. 결과는 <code>safety_boundary(1) &gt; deterioration(2)</code>, direct pointer 각 1, source detail canary 1·G6 projection canary 0, raw transcript/임상 주장 0이고 replay가 멱등이다. 상세: <code>ops/evidence/g6-safety-priority-runtime-scratch-20260807.json</code>, <code>ops/outcome-os-g6-version-comparison-producer-evidence-2026-08-07.md</code>.</p></div></div>
           </article>
           <article class="scard" data-status="doing" data-cat="Outcome OS·음성" data-owner="0">
-            <button class="scard-head" aria-expanded="false"><span class="chip c-doing">G7 GATE · INTERNAL DONE · EXTERNAL PROOF</span><span class="scard-mid"><span class="scard-title">Multimodal Alliance — 음성·비언어 동맹 신호</span><span class="scard-sum">내부 안전·복구·용량 계약은 닫았고 실제 provider·동의 마이크·사람 평가 증거를 기다린다.</span></span><span class="caret" aria-hidden="true"></span></button>
-             <div class="scard-body"><div class="kv k-good"><b>내부 구현 DONE</b><p>consent→단일 clock→독립 text/voice/fusion→철회·tombstone, streaming interim/final·word timestamp·provider event, HMAC word pseudonym, 열린 stream의 1초 동의 재검사·abort, 텍스트 보존·음성 재연결 UX를 연결했다. 격리 synthetic PCM soak는 59/59 연결 종료·성공 발화 55·철회 차단 2·미동의 차단 1·overflow 거부/복구 1/1·10MiB 선초과 거부를 통과했고, G7 focused 119 passed·Ruff·compile을 통과했다. 공개 WSS preflight는 TLS 1.3/Cloudflare 연결과 비인증 1008 차단, 마이크 열거·캡처 0을 확인했다. 증거: <code>ops/evidence/g7-public-wss-preflight-current-20260807.json</code>.</p></div><div class="kv k-warn"><b>외부 종료 GATE</b><p>실제 Deepgram 운영 key·quota와 live interim/final, 기대값과 일치하는 authenticated public WSS ready, 실행 직전 명시 동의 물리 마이크 50분 양방향 soak, 같은 public host·겹치는 시간창의 worker/Uvicorn queue와 exact image·cgroup/proc/Docker/TCP high-water, 30명/50회기/150축 독립 라벨 held-out voice-gain이 필요하다. 네 artifact가 <code>scripts/check-g7-external-proof.py</code> exit 0을 만들기 전에는 메인 상태를 DONE으로 바꾸지 않는다. 현재 canonical checker exit 1은 이 외부 증거 부재를 정직하게 차단한 결과다.</p></div></div>
+            <button class="scard-head" aria-expanded="false"><span class="chip c-doing">G7 GATE · INTERNAL DONE · EXTERNAL PROOF</span><span class="scard-mid"><span class="scard-title">Multimodal Alliance — 음성·비언어 동맹 신호</span><span class="scard-sum">내부 안전·복구·용량 계약은 닫았고 current 공개 runtime·동의 마이크·사람 평가 증거를 기다린다.</span></span><span class="caret" aria-hidden="true"></span></button>
+              <div class="scard-body"><div class="kv k-good"><b>내부 구현 DONE</b><p>consent→단일 clock→독립 text/voice/fusion→철회·tombstone, streaming interim/final·word timestamp·provider event, HMAC word pseudonym, 열린 stream의 1초 동의 재검사·abort, 텍스트 보존·음성 재연결 UX를 연결했다. 운영 기본 provider는 노트북 상주 <code>local_whisper</code>/<code>melotts</code>이고 외부 Deepgram/OpenAI adapter는 fallback으로 보존한다. 격리 synthetic PCM soak는 59/59 연결 종료·성공 발화 55·철회 차단 2·미동의 차단 1·overflow 거부/복구 1/1·10MiB 선초과 거부를 통과했다. Windows host topology는 detached-clean commit/tree·도구 SHA·<code>psutil</code> version과 PID/start/exe·command SHA/cwd·process/TCP high-water를 fail-closed로 수집하고, 3,120초 capture의 공통 3,000초를 canonical exit와 결속한다. current source의 public launcher도 sidecar-before-API lifecycle, <code>local_whisper/small/cpu-int8</code>·<code>melotts/melotts-korean</code> exact readiness, provider env, Uvicorn <code>--ws websockets --ws-max-queue 4</code>, fresh API/cloudflared provenance receipt를 연결했다. runner/checker/topology 86/86·launcher/sidecar 80/80·통합 166/166·API voice 71/71을 통과했다.</p></div><div class="kv k-warn"><b>외부 종료 GATE</b><p>새 launcher는 아직 public에 실행하지 않았다. 현재 public API는 Git metadata가 없는 냉동 release cwd와 OpenAI voice provider로 실행돼 새 Windows provenance gate를 통과하지 못한다. 검증된 clean commit 기반 runtime으로 정렬하고 <code>/admin/voice-runtime</code>과 local provider/model ready를 실제 공개 경로에서 확인한 뒤 authenticated public WSS, 실행 직전 명시 동의 물리 마이크 50분 양방향 soak, 같은 public host·공통 3,000초 시간창의 worker/Uvicorn queue와 process/TCP high-water, 30명/50회기/150축 독립 라벨 held-out voice-gain을 수집해야 한다. 네 artifact가 <code>scripts/check-g7-external-proof.py</code> exit 0을 만들기 전에는 메인 상태를 DONE으로 바꾸지 않는다.</p></div></div>
           </article>
-          <article class="scard" data-status="done" data-cat="Outcome OS·에이전틱" data-owner="0">
-            <button class="scard-head" aria-expanded="false"><span class="chip c-done">G8 DONE</span><span class="scard-mid"><span class="scard-title">Autonomous Content &amp; Continuous Improvement</span><span class="scard-sum">receipt-bound rollback executor가 격리 NAS에서 실제 image rollback과 restore를 두 번의 executed receipt로 실행했다.</span></span><span class="caret" aria-hidden="true"></span></button>
-            <div class="scard-body"><div class="kv"><b>agentic worker + 운영 환류 + human gate</b><p>승인 source의 실제 hash·PII를 engine 호출 전에 검사하고 structured generator 1개, 결과를 공유하지 않는 red-team 2개, variant generator와 variant별 독립 judge 3개 이상을 실행한다. 정답 누수·PII·unknown source claim·open finding·안전/보상 해킹·모델/structured 실패는 store 호출 전에 차단한다. repo-approved source는 기본 비활성 scheduler가 durable lease/retry job으로 관리한다. 실제 <code>claude_cli/claude-opus-4-8</code> 7 calls와 dev PostgreSQL reviewer 2·variant 3·pass rate 1.0을 거쳐 synthetic payload를 <code>pending_human_approval</code>로 저장했다. G6 canonical drift trigger는 metadata-only incident→DAG→job을 원자 enqueue하고, 실제 pending 후보의 관리자 검수는 catalog 0→1·approval 1과 역할 403·멱등/409·민감정보 비노출을 통과했다. 별도 누수 후보는 422·저장 0이다. 상세: <code>ops/outcome-os-g8-agentic-worker-evidence-2026-08-07.md</code>.</p></div><div class="kv k-good"><b>current NAS runtime</b><p>release-only SHA <code>6030a677…c611</code>를 전용 NAS Compose 프로젝트에 승격했다. API/Web 이미지 <code>52e0…8b2d</code>/<code>6fdb…f215</code>, health 3/3·db/engine true, OpenAPI 126·auth 401·G0~G8, browser E2E 108/108과 실제 SSE→DB-backed review를 확인했다. named DB volume과 predeploy dump를 보존했다.</p></div><div class="kv k-good"><b>실제 rollback receipt DONE</b><p>runtime+release_gate 전용 executor는 승인·idempotency·artifact·Compose/env/resolved-policy SHA와 exact API/Web image를 일회성 manifest에 결속하고 HMAC journal·crash recovery·previous-image 복구를 고정한다. 2026-08-07 격리 NAS에서 별도 loopback control-plane API(<code>127.0.0.1:8018</code>)와 별도 executor(<code>127.0.0.1:18149</code>)로 <b>실제 image rollback 2회</b>를 실행했다. <code>rollback-old</code>는 receipt <code>nas-g8-723eeef2…</code>로 previous 이미지 <code>79ec…4450</code>/<code>c530…2f28</code>를, <code>restore-current</code>는 receipt <code>nas-g8-2738846c…</code>로 current 이미지 <code>52e0…8b2d</code>/<code>6fdb…f215</code>를 활성화했다. release gate·approval 각각 2회 멱등, lifecycle <code>rollback/executed</code> 2건, 승인 <code>authorize_rollback</code> 2건, silent auto-promotion 0, HMAC journal 6-record 체인 검증, health 3/3·OpenAPI 126·auth 401·Web 200을 확인했다. helper는 image 상속 compose label을 baseline으로 두고 project/service를 격리 override하는 계약으로 검증했다(<code>launch-nas-preview-g8-helpers.py</code>, 37/37). 상세: <a href="./ops/nas-preview-g8-rollback-proof-runbook.md">런북</a> · <a href="./ops/evidence/nas-preview-g8-actual-rollback-2026-08-07.json">기계 판독 증거</a>.</p></div></div>
+          <article class="scard" data-status="doing" data-cat="Outcome OS·에이전틱" data-owner="0">
+            <button class="scard-head" aria-expanded="false"><span class="chip c-doing">G8 BUILD · RECEIPT DONE · RUNTIME REVALIDATION</span><span class="scard-mid"><span class="scard-title">Autonomous Content &amp; Continuous Improvement</span><span class="scard-sum">실제 rollback receipt는 완료됐다. 비-secure origin UUID 수정 배포와 NAS-origin 회기 E2E 재검증이 남았다.</span></span><span class="caret" aria-hidden="true"></span></button>
+             <div class="scard-body"><div class="kv"><b>agentic worker + 운영 환류 + human gate</b><p>승인 source의 실제 hash·PII를 engine 호출 전에 검사하고 structured generator 1개, 결과를 공유하지 않는 red-team 2개, variant generator와 variant별 독립 judge 3개 이상을 실행한다. 정답 누수·PII·unknown source claim·open finding·안전/보상 해킹·모델/structured 실패는 store 호출 전에 차단한다. repo-approved source는 기본 비활성 scheduler가 durable lease/retry job으로 관리한다. 실제 <code>claude_cli/claude-opus-4-8</code> 7 calls와 dev PostgreSQL reviewer 2·variant 3·pass rate 1.0을 거쳐 synthetic payload를 <code>pending_human_approval</code>로 저장했다. G6 canonical drift trigger는 metadata-only incident→DAG→job을 원자 enqueue하고, 실제 pending 후보의 관리자 검수는 catalog 0→1·approval 1과 역할 403·멱등/409·민감정보 비노출을 통과했다. 별도 누수 후보는 422·저장 0이다. 상세: <code>ops/outcome-os-g8-agentic-worker-evidence-2026-08-07.md</code>.</p></div><div class="kv k-warn"><b>NAS-origin runtime 재검증</b><p>SHA <code>6030a677…c611</code>의 API/Web 이미지는 health 3/3·db/engine true, OpenAPI 126·auth 401·실제 SSE→DB-backed review를 통과했다. 그러나 108/108은 localhost candidate 결과였고 같은 NAS 평문 origin에서는 <code>crypto.randomUUID</code> 예외로 24건이 실패했다. 소스의 <code>randomUuid()</code> 수정은 source-only Vite 6/6·typecheck·build를 통과했다. clean-head controller도 HEAD/tree/archive 2회 결정성·archive-only candidate·patch 무회귀와 commit 전 actual-origin 11-spec rollback gate를 unit 30/30로 고정했고 새 predeploy dump <code>72698232…5d41c</code>를 보존했다. 두 execute는 모두 승격 전 fail-closed되어 mutation 0이다. 후속으로 UTC timestamp·KST 날짜 계약을 구현해 API 전체 921 passed와 KST 실DB browser 코칭 이력 1/1을 통과했다. 사용자 승인 아래 새 clean commit을 결속하고 동일 NAS-origin 회기 묶음이 GREEN이 되기 전에는 G8 전체를 DONE으로 올리지 않는다.</p></div><div class="kv k-good"><b>실제 rollback receipt DONE</b><p>runtime+release_gate 전용 executor는 승인·idempotency·artifact·Compose/env/resolved-policy SHA와 exact API/Web image를 일회성 manifest에 결속하고 HMAC journal·crash recovery·previous-image 복구를 고정한다. 2026-08-07 격리 NAS에서 별도 loopback control-plane API(<code>127.0.0.1:8018</code>)와 별도 executor(<code>127.0.0.1:18149</code>)로 <b>실제 image rollback 2회</b>를 실행했다. <code>rollback-old</code>는 receipt <code>nas-g8-723eeef2…</code>로 previous 이미지 <code>79ec…4450</code>/<code>c530…2f28</code>를, <code>restore-current</code>는 receipt <code>nas-g8-2738846c…</code>로 current 이미지 <code>52e0…8b2d</code>/<code>6fdb…f215</code>를 활성화했다. release gate·approval 각각 2회 멱등, lifecycle <code>rollback/executed</code> 2건, 승인 <code>authorize_rollback</code> 2건, silent auto-promotion 0, HMAC journal 6-record 체인 검증, health 3/3·OpenAPI 126·auth 401·Web 200을 확인했다. helper는 image 상속 compose label을 baseline으로 두고 project/service를 격리 override하는 계약으로 검증했다(<code>launch-nas-preview-g8-helpers.py</code>, 37/37). 상세: <a href="./ops/nas-preview-g8-rollback-proof-runbook.md">런북</a> · <a href="./ops/evidence/nas-preview-g8-actual-rollback-2026-08-07.json">기계 판독 증거</a>.</p></div></div>
           </article>
         </div>
       </div>
@@ -917,9 +935,9 @@
             <article class="phase-card current"><div class="phase-top"><span class="phase-id">Phase 0</span><span class="tag doing">closing</span></div><h3>기반 정렬 / 운영 안전장치</h3><p>인프라, 인증 경계, fail-closed, 공개 배포, 회귀 테스트 안정화.</p><ul class="phase-list"><li><b>상태:</b> 대부분 완료, 공개 <code>/turn</code> proof만 남음</li><li><b>검증:</b> build + backend 178 기준선 + Playwright 113 기준선, Node/backend focused 120</li><li><b>운영:</b> prod API 8001, engine 9099, tunnel 1개</li></ul></article>
             <article class="phase-card next"><div class="phase-top"><span class="phase-id">Phase 1</span><span class="tag doing">next</span></div><h3>MVP 코어 루프</h3><p>1 페르소나 상담, 실제 턴 저장, 회기말 피드백, 저항 엔진 검증.</p><ul class="phase-list"><li><b>DoD:</b> 로그인 → P1 상담 완주 → 피드백 수신</li><li><b>추가:</b> 음성 왕복 1턴 PoC 포함</li><li><b>증거:</b> cost/turn DB 적재 + openness 곡선 대조</li></ul></article>
             <article class="phase-card"><div class="phase-top"><span class="phase-id">Phase 2a</span><span class="tag info">planned</span></div><h3>3역할 / OAuth / 페르소나</h3><p>학습자, 교수자, 관리자 권한 분리와 페르소나 확장.</p><ul class="phase-list"><li><b>DoD:</b> 타인 session 직접 접근 403</li><li><b>범위:</b> OAuth BFF, RBAC, 교수 검수 루프</li><li><b>주의:</b> visible_to와 인간 권한은 별도 레이어</li></ul></article>
-            <article class="phase-card"><div class="phase-top"><span class="phase-id">Phase 2b</span><span class="tag info">planned</span></div><h3>음성 캐스케이드</h3><p>STT → 엔진 → TTS 왕복, WSS/터널 안정성, barge-in 로깅.</p><ul class="phase-list"><li><b>DoD:</b> 50분 WSS 끊김 실측</li><li><b>범위:</b> Deepgram STT, OpenAI TTS, voice preset</li><li><b>리스크:</b> 실시간 레이턴시는 실측 전 완료 표기 금지</li></ul></article>
+            <article class="phase-card"><div class="phase-top"><span class="phase-id">Phase 2b</span><span class="tag info">planned</span></div><h3>음성 캐스케이드</h3><p>STT → 엔진 → TTS 왕복, WSS/터널 안정성, barge-in 로깅.</p><ul class="phase-list"><li><b>DoD:</b> 50분 WSS 끊김 실측</li><li><b>범위:</b> local_whisper STT + MeloTTS 기본, Deepgram/OpenAI fallback</li><li><b>리스크:</b> 실시간 레이턴시는 실측 전 완료 표기 금지</li></ul></article>
             <article class="phase-card"><div class="phase-top"><span class="phase-id">Phase 3</span><span class="tag info">planned</span></div><h3>교육용 파일럿 / 효과성</h3><p>수련생 파일럿, 사전사후 효과 측정, 재귀학습 데이터셋 산출.</p><ul class="phase-list"><li><b>DoD:</b> 20명 완주 + KPI 충족</li><li><b>측정:</b> SUS, 자기효능감, κ/ICC, 환각률</li><li><b>정정:</b> IRB 게이트가 아니라 데이터 활용동의/개인정보 게이트</li></ul></article>
-            <article class="phase-card next"><div class="phase-top"><span class="phase-id">Outcome OS</span><span class="tag doing">G7 external proof</span></div><h3>성과·동맹·수련 폐루프</h3><p>측정 → 이상 탐지 → 원인 가설 → 재연습 → 전이 검증 → 숙련도 갱신.</p><ul class="phase-list"><li><b>상태:</b> G0~G6 internal DONE · G8 실제 NAS rollback receipt DONE · G7 외부 voice/resource/human 대기</li><li><b>완료 DAG:</b> AOS-001~012</li><li><b>운영:</b> current source NAS SHA <code>6030a677…c611</code> 승격 완료 · G8 loopback control-plane rollback/restore receipt 2건 · G7 canonical four-artifact checker 준비</li></ul></article>
+            <article class="phase-card next"><div class="phase-top"><span class="phase-id">Outcome OS</span><span class="tag doing">G7 external · G8 runtime</span></div><h3>성과·동맹·수련 폐루프</h3><p>측정 → 이상 탐지 → 원인 가설 → 재연습 → 전이 검증 → 숙련도 갱신.</p><ul class="phase-list"><li><b>상태:</b> G0~G6 internal DONE · G8 실제 NAS rollback receipt DONE/runtime 재검증 중 · G7 외부 voice/resource/human 대기</li><li><b>완료 DAG:</b> AOS-001~012</li><li><b>운영:</b> NAS SHA <code>6030a677…c611</code>은 UUID 수정 전 빌드 · G8 receipt 2건 완료 · 수정 배포/NAS-origin E2E와 G7 canonical four-artifact checker exit 0 필요</li></ul></article>
           </div>
           <div class="source-note">정정 기준: <code>MASTERPLAN</code> 원본의 IRB 신청/승인 게이트는 <code>MASTERPLAN_REVISIONS</code> 기준으로 제거한다. Phase 2는 2a(3역할/OAuth/페르소나)와 2b(음성 캐스케이드)로 분리하고, Phase 1 DoD에는 얇은 음성 왕복 1턴 PoC를 포함한다.</div>
         </div>
@@ -1006,7 +1024,7 @@
                 <div class="task-row"><div><span class="task-status s-done">DONE</span></div><div><b>OpenAI TTS voice preset 추상화</b><p>P1/P2/P3 persona voice preset, invalid preset fallback, speed clamp, instructions payload 계약을 회귀화했고, <code>app.persona_voice_map</code>을 live <code>/voice/ws</code> TTS 선택에 연결했다. 명시 preset은 DB map보다 우선하고, OpenAI가 아닌 provider row는 기존 fallback으로 안전하게 흡수한다.</p></div><div><b>산출물</b><p><code>resolve_voice</code>, <code>resolve_voice_from_map</code>, <code>build_tts_payload</code>, <code>get_session_voice_map</code>, seed voice map row, dev runtime schema guard</p></div><div><b>검증</b><p><code>pytest app/test_runtime_policy.py app/test_persona_review.py app/test_voice_service.py app/test_voice_ws.py -q</code> 75 passed; full API 178 passed + gateway 11 passed.</p></div></div>
                 <div class="task-row"><div><span class="task-status s-done">POC DONE</span></div><div><b>P1 서연 무참조 synthetic voice 샘플</b><p>Higgs v3 로컬 런타임에서 실존 reference voice 없이 synthetic seed를 먼저 만들고, 그 seed만 재참조해 우울·피로·불안·라포·회복감 5개 변주를 생성했다. 개발용 <code>VIGNETTE_VOICE_POC_SAMPLE_TTS</code> 플래그로 <code>/voice/ws</code> P1 sample TTS provider에도 연결했다.</p></div><div><b>산출물</b><p><code>docs/archive/voice-art/bimec-persona-voice-poc-2026-06-27.md</code>, <code>docs/voice-art/p1-seoyeon-higgs-v3-20260627/manifest.json</code>, <code>apps/api/app/services/voice.py</code></p></div><div><b>검증</b><p>mp3/wav 6개(seed+5) 생성, 24kHz, 7.72~11.68초. live <code>/voice/ws</code> text_turn smoke: provider <code>p1-sample-poc</code>, binary 20 chunks/78,573 bytes. 샘플 provider는 TTS override만 담당하고 마이크/STT는 OpenAI 키가 필요하다. 프로덕션 탑재는 모델 라이선스·권리정책 결정 전 금지.</p></div></div>
                 <div class="task-row"><div><span class="task-status s-done">LOCAL DONE</span></div><div><b>barge-in / paralinguistic logging</b><p>음성 learner turn에 audio_ref, silence_ms, speech_rate, barge_in을 nullable 메타로 저장하고, 회기 리뷰에서 침묵·발화 속도·끼어듦·음성 입력 비언어 칩으로 표시한다. 2차로 <code>provider_events</code> JSONB 보존 슬롯을 추가해 control/STT provider 이벤트를 allowlist·size limit 후 저장하고, 3차로 내부 taxonomy <code>event_type</code>/<code>category</code>를 붙인다. 4차로 인증된 회기 리뷰에는 한숨·울음·웃음·호흡·운율·배경소음 같은 정규화 이벤트만 label/detail 칩으로 제한 노출한다. 실제 Session 마이크 UI는 browser voice activity/trailing silence 메타를 <code>audio_end</code>에 싣고, readiness는 음성 메타 5개 컬럼 전체를 확인한다. raw transcript/text/provider/source/raw type은 응답에서 제외하고, 공개 공유 카드는 축어록과 provider raw를 계속 싣지 않는다.</p></div><div><b>산출물</b><p><code>app.turns.provider_events</code>, <code>TurnRecord.provider_events</code>, voice route 이벤트 sanitizing/taxonomy, <code>ReviewNonverbalEvent</code>, <code>SessionReview</code> 칩 UI, browser voice metadata capture, voice metadata readiness guard</p></div><div><b>검증</b><p><code>python -X utf8 -m pytest -p no:cacheprovider app/test_runtime_policy.py app/test_session_turn_persistence.py app/test_voice_ws.py app/test_voice_service.py -q</code> 77 passed; provider_events DB insert placeholder/args, WS raw key drop, STT+control event merge, internal taxonomy, client turn 미혼입, review 파생 칩 raw provider 미노출, 침묵 칩 중복 방지, 5-column readiness 검증. <code>PLAYWRIGHT_PORT=5197 npx playwright test e2e/voice-success.spec.ts --project=chromium-single-run --workers=1</code> 2 passed, <code>PLAYWRIGHT_PORT=5199 npx playwright test e2e/session-persistence.spec.ts --project=chromium-single-run --workers=1</code> 5 passed, <code>npm run typecheck</code>.</p></div></div>
-                <div class="task-row"><div><span class="task-status s-plan">GATE</span></div><div><b>공개·실기기 음성 장시간 실측</b><p>Deepgram adapter, HMAC word pseudonym, 1초 동의 재검사, 공통 consent transaction lock, bounded queue/10MiB cap, recovery UX와 provider/model ready 계약은 내부 완료다. 남은 범위는 실제 Deepgram key·quota live, 기대 provider/model authenticated public WSS, 명시 동의 물리 마이크, 50분 양방향 soak, 독립 라벨 voice-gain benchmark, 실제 운영 topology resource high-water와 provider 기반 한숨·울음 표본이다. mic-free preflight와 synthetic E2E/label은 이를 대체하지 않는다.</p></div><div><b>산출물</b><p>expected provider/model public WSS ready log, Deepgram interim/final 표본, explicit-consent physical mic capture log, 50분 soak evidence, independently labeled voice-gain report, worker/proxy resource high-water, provider paralinguistic event sample</p></div><div><b>검증</b><p>실제 공개/실기기/외부 provider 환경에서만 완료 가능. 현재는 B2 음성 캐스케이드 live gate로 추적한다.</p></div></div>
+                <div class="task-row"><div><span class="task-status s-plan">GATE</span></div><div><b>공개·실기기 음성 장시간 실측</b><p>provider-neutral streaming adapter, HMAC word pseudonym, 1초 동의 재검사, 공통 consent transaction lock, bounded queue/10MiB cap, recovery UX와 provider/model ready 계약은 내부 완료다. 남은 범위는 current committed source 기반 public launcher와 <code>local_whisper</code>/<code>melotts</code> exact ready, authenticated public WSS, 명시 동의 물리 마이크, 50분 양방향 soak, 독립 라벨 voice-gain benchmark, 실제 운영 topology resource high-water와 provider 기반 한숨·울음 표본이다. Deepgram/OpenAI는 fallback이며 mic-free preflight와 synthetic E2E/label은 외부 증거를 대체하지 않는다.</p></div><div><b>산출물</b><p>expected provider/model public WSS ready log, local Whisper interim/final 표본, explicit-consent physical mic capture log, 50분 soak evidence, independently labeled voice-gain report, worker/proxy resource high-water, provider paralinguistic event sample</p></div><div><b>검증</b><p>실제 공개/실기기/운영 provider 환경에서만 완료 가능. 현재는 B2 음성 캐스케이드 live gate로 추적한다.</p></div></div>
                 <div class="task-row"><div><span class="task-status s-done">DECIDED</span></div><div><b>s2s 2차 PoC 판단</b><p>소유자 결정(2026-06-30): s2s 2차 PoC 유지. 캐스케이드 1차를 운영 기준으로 두고 <code>voice-s2s-poc.md</code> 비교 PoC를 계속 연다. 최종 채택/폐기는 비교 리포트 이후 재판단한다. 채택 여부 자체는 확정됐고, 비교 PoC 구현·실측이 후속 build로 남는다.</p></div><div><b>산출물</b><p><code>docs/decisions/voice-s2s-poc.md</code></p></div><div><b>검증</b><p>transcript, safety, audit, latency, failure, privacy 기준 명시. 실제 비교 실측은 후속.</p></div></div>
               </div>
             </div>
@@ -1047,7 +1065,7 @@
                 <tbody>
                   <tr><td>Web typecheck</td><td><code>npm run typecheck</code></td><td>Passed</td></tr>
                   <tr><td>Design SSOT / auth visual</td><td><code>npm run check:design-ssot</code> / <code>npx playwright test e2e/auth-visual.spec.ts --project=chromium-single-run --reporter=line</code> / <code>npx playwright test e2e/layout-visual-gate.spec.ts --project=chromium-single-run --reporter=line</code></td><td>SSOT checker passed; login/onboarding light-dark desktop-mobile 1 passed; 14 core screens × 7 widths visual gate 14 passed.</td></tr>
-                  <tr><td>Full Playwright E2E baseline</td><td><code>npm run e2e:parallel</code> / <code>npm run e2e:single-run</code> / <code>npm run e2e:list</code></td><td>2026-08-07 현재 수집은 <b>610 tests / 44 files</b>다. 현 작업트리의 610개 전체 GREEN은 아직 검증 전이며, 2026-07-15의 fixture desktop/mobile 166/166 + DB/engine/provider 직렬 49/49 = 215/215는 과거 기준선으로만 보존한다.</td></tr>
+                  <tr><td>Full Playwright E2E baseline</td><td><code>npm run e2e:parallel</code> / <code>npm run e2e:single-run</code> / <code>npm run e2e:list</code></td><td>2026-08-09 현재 수집은 <b>614 tests / 44 files</b>다. 현 작업트리의 614개 전체 GREEN은 아직 검증 전이며, current 핵심 fixture는 불변 110 + 최신 dashboard 10의 분할 GREEN이다. 이전 단일 120/120과 2026-07-15의 fixture desktop/mobile 166/166 + DB/engine/provider 직렬 49/49 = 215/215는 범위가 다른 역사 기준선으로 보존한다.</td></tr>
                   <tr><td>Refactor governance P1~P8</td><td><code>ruff check app</code> / <code>pytest -q app</code> / <code>pytest -q engine_gateway</code> / <code>npm run typecheck</code> / <code>npm run check:api-types</code> / <code>npm run check:design-ssot</code> / <code>npm run check:dead-code</code> / <code>npm run check:duplication</code> / <code>npm run build</code> / <code>npm audit --audit-level=high</code> / full Playwright</td><td>Backend 400 passed, gateway 29 passed, web gates/build/audit passed, vulnerabilities 0, production duplication 1 clone/15 lines/0.03%, Playwright 215/215 passed. 상세 근거는 <code>ops/refactor-governance-2026-07-15.md</code>.</td></tr>
                   <tr><td>API typegen SSOT</td><td><code>npm run check:api-types</code></td><td>Passed; FastAPI OpenAPI → <code>src/lib/api.gen.ts</code> stale check</td></tr>
                   <tr><td>Outcome &amp; Alliance OS G0</td><td><code>py -3.11 -X utf8 -m pytest -p no:cacheprovider apps/api/app/test_measurement_contract.py apps/api/app/test_runtime_schema_ssot.py -q</code> / <code>scripts/check-measurement-ledger.sql</code> / measurement·API contract checks / web typecheck / DB-backed <code>session-persistence</code> focused E2E 3종</td><td>G0 contract/schema 11 passed, 기존 backend 100 passed, auth 39 passed. Python→JSON Schema→TypeScript→PostgreSQL enum·필수필드 계약이 일치하고 8개 deterministic benchmark가 검증됐다. Live PostgreSQL에서 learner/client/evaluator 가시 행 1/1/2, 교차 누수 0, append-only guard 2를 확인했다. 학습자 턴→교수자 대시보드, 워크시트 검수, 종료 deep 평가→durable 리뷰 E2E는 각각 1 passed. G0/AOS-001~004 완료.</td></tr>
@@ -1108,7 +1126,7 @@
                   <tr><td>Crisis safety gate UI</td><td><code>PLAYWRIGHT_PORT=5193 npx playwright test e2e/session-mvp.spec.ts --project=chromium-single-run --workers=1</code> / <code>PLAYWRIGHT_PORT=5259 npx playwright test e2e/session-mvp.spec.ts --project=chromium-desktop --workers=1 --grep "voice conversation stop"</code></td><td>mock SSE <code>safety</code> + <code>done.conversation_stopped</code>와 mock voice <code>reply.conversation_stopped</code>에서 안전 자원 109와 입력 disabled가 유지되고, 빈 client reply를 <code>내담자 응답 없음</code>으로 덮지 않으며 live-coach를 호출하지 않는지 검증한다. 음성 위기 경로는 TTS 종료 이벤트 없이도 socket close를 확인한다.</td></tr>
                   <tr><td>Persona/session review UI E2E</td><td><code>PLAYWRIGHT_PORT=5215 npx playwright test e2e/teacher.spec.ts --project=chromium-single-run --workers=1</code></td><td>9 passed mixed suite; real server-row rendering과 route-fixture UI 흐름을 함께 포함한다. 교수자가 pending persona를 승인하고, pending/recent review detail로 진입하며, 별도 student analysis 메뉴·학습자 검색·행 펼침·full learner timeline drilldown을 검증한다.</td></tr>
                   <tr><td>Voice UI synthetic E2E</td><td><code>npx playwright test e2e/voice-success.spec.ts --project=chromium-single-run</code> / <code>PLAYWRIGHT_PORT=5248 npx playwright test e2e/session-mvp.spec.ts --project=chromium-single-run --workers=1 --grep "pending voice transcript"</code></td><td>voice-success 2 passed + pending transcript failure UI 1 passed; direct WS cascade, Session 텍스트 턴의 persisted reply <code>/voice/speech</code>→OpenAI speech→Web Audio 재생, Session mic button path with synthetic browser audio/Web Audio playback, and final transcript followed by persistence failure becoming a visible <code>저장 실패</code> turn instead of a silent successful transcript</td></tr>
-                  <tr><td>G7 explicit consent · external proof</td><td><code>pytest app/test_g7_voice_gain_evidence.py app/test_voice_runtime.py ...</code> / <code>pytest scripts/test_g7_external_proof.py scripts/test_g7_runtime_evidence.py scripts/test_g7_topology_evidence.py scripts/test_g7_external_voice_soak.py</code> / <code>voice-success.spec.ts</code></td><td>API/G7 92 passed, evidence runner/checker·release gate 31 passed, voice UI 2/2. 서버 30일·원음 미보존 consent ledger 성공 전 getUserMedia/voice WS 0회, public v4 interim/final latency, worker/Uvicorn·Linux topology high-water와 independent human-held-out gate를 fail-closed로 고정했다. exact SHA <code>a8c27b0a…1a0d</code> NAS 승격과 clean candidate session E2E 24/24도 통과했다. 실제 마이크·Deepgram·human evidence는 미실행이라 G7 BUILD.</td></tr>
+                  <tr><td>G7 explicit consent · external proof</td><td><code>pytest app/test_g7_voice_gain_evidence.py app/test_voice_runtime.py ...</code> / <code>python -m unittest scripts/test_g7_external_proof.py scripts/test_g7_topology_evidence.py ...</code> / <code>voice-success.spec.ts</code></td><td>내부 voice/G7 계약과 consent ledger, 동의 전 getUserMedia/voice WS 0회, public v4 interim/final latency, worker/Uvicorn 및 Linux/Windows topology, independent human-held-out gate를 fail-closed로 고정했다. runner/checker/topology는 86/86, public launcher/sidecar는 80/80, G7 통합은 166/166, API voice 통합은 71/71·Ruff·compile을 통과했다. 현재 public API는 Git 없는 냉동 release cwd라 provenance gate를 통과하지 못하고 <code>local_whisper</code>/<code>melotts</code> sidecar도 미기동이다. 실제 명시 동의 마이크·50분·동시 runtime/topology·human evidence가 없어 G7 external GATE다.</td></tr>
                   <tr><td>Voice s2s decision memo</td><td><code>docs/decisions/voice-s2s-poc.md</code></td><td>criteria recorded; keep/drop decision remains owner DECIDE</td></tr>
                   <tr><td>Hanshin data/SSO gate</td><td><code>docs/ops/hanshin-data-governance-gate.md</code></td><td>artifact created; written external evidence still required</td></tr>
                   <tr><td>Hanshin feedback 1차 improvement pack</td><td><code>docs/ops/hanshin-feedback-improvement-plan-2026-07-03.md</code> / <code>docs/redteam/hanshin-feedback-plan-redteam-2026-07-03.md</code> / <code>docs/redteam/hanshin-feedback-plan-counter-redteam-2026-07-03.md</code> / backend+web implementation</td><td>1차 implemented: P1 role mapping + client-only history injection, P2 quality retry/no-save gate + SSE full-response buffer, P3 review display humanization/raw error mapper/fast-deep labels/client feedback label, P4 supervisor scope panel. Verification: backend focused 84 passed, web typecheck and API type check passed, session-review focused 8 passed, layout visual gate 12 passed, session-layout 8 passed. Remaining follow-ups are stored fallback metadata, lower-latency partial stream policy, fast/deep reconciliation, resident namespace/prompt caching, and clinical rubric/CBT wording gates.</td></tr>
@@ -1124,9 +1142,11 @@
                   <tr><td>Docker image smoke</td><td><code>docker build -f apps/api/Dockerfile .</code> / <code>docker run ... python -c "import app.main"</code> / <code>docker build -f apps/web/Dockerfile apps/web</code></td><td>API/Web image build and API import smoke pass after packaging cleanup. Web build uses npm lockfile and ignores host <code>node_modules</code>; API image excludes local <code>.env</code> files.</td></tr>
                   <tr><td>Deploy preflight</td><td><code>python scripts\check-deploy-preflight.py --skip-db --env-file infra\.env.example --allow-placeholder-secrets</code> / DB mode with local <code>DATABASE_URL</code></td><td>Passed: exact-pinned API requirements, live coaching <code>data/kb</code> source pack, env template keys, and DB readiness (<code>current_user=vignette</code>). DB mode can additionally check app-role DSN with <code>--require-app-role</code> and now verifies session read-model columns including <code>app.turns</code> voice metadata columns(<code>audio_ref</code>/<code>silence_ms</code>/<code>speech_rate</code>/<code>barge_in</code>/<code>provider_events</code>) plus worksheet review columns.</td></tr>
                   <tr><td>Fresh compose smoke</td><td><code>docker compose -p vignette-packaging-smoke -f infra/docker-compose.yml up -d --build</code> + proxy <code>/api/health</code></td><td>Passed with dummy production-safe env: API healthy, DB healthy, web/proxy up, <code>http://localhost:18080/api/health</code> 200 with <code>db:true</code>, <code>engine:true</code>, <code>engine_mode:"claude_cli"</code>. Smoke volumes/network removed after run.</td></tr>
-                  <tr><td>격리 NAS 프리뷰 · 회기 E2E 자동화</td><td><code>http://100.116.83.60:8088</code> / <code>vignette-e2e</code> 매일 04:30 KST / <a href="./ops/nas-preview-deployment-evidence-2026-08-07.md">배포 증거</a> / <a href="./ops/evidence/nas-preview-current-deploy-2026-08-07.json">기계 판독 증거</a></td><td>current SHA <code>6030a677…c611</code>을 전용 Compose 프로젝트·포트·네트워크·named volume에 승격했다. browser E2E 108/108, health 3/3, OpenAPI 126·auth 401·G0~G8, postdeploy SSE→DB review를 통과했고 predeploy dump와 이전 exact images를 보존했다. 자동화는 ACTIVE이며 material milestone+release gate+배포 SHA 변경 때만 프리뷰를 갱신한다. G7 외부 mic/provider/human 증거는 별도다.</td></tr>
-                  <tr><td>G7 외부 증거 3-artifact 동시 시간창 오케스트레이터</td><td><code>scripts/run-g7-external-proof-window.py</code> · <a href="./ops/outcome-os-g7-external-proof-readiness-2026-08-07.md">준비 문서</a></td><td>soak·runtime·topology 세 캡처는 같은 host의 겹치는 시간창이어야 하는데 지금까지는 운영자가 세 명령을 손으로 맞춰야 했다. 한 명령으로 동시에 띄우고 checker까지 잇도록 묶었다. 게이트는 약화시키지 않았다 — CLI 실증 fail-closed 4종: 동의·장치 없음 <code>physical_microphone_consent_required</code>, human pack 없음 <code>human_voice_gain_pack_required</code>, 50분 미만 <code>production_window_too_short</code>, host 불일치 <code>hosts_must_match</code>, 전부 exit 2. <code>--rehearse</code>는 마이크를 열지 않고 배관만 확인하며 <code>gate_closed</code>는 항상 false다. 회귀 <code>20/20</code>. <b>선행 조건 발견:</b> 공개 런타임은 119 paths 구버전이라 <code>/admin/voice-runtime</code>이 배포돼 있지 않아 마이크·사람을 준비해도 artifact 2 에서 실패한다. current source 를 공개에 먼저 승격해야 하며, 오케스트레이터가 시작 전 <code>admin_voice_runtime_not_deployed</code>로 막는다(실측 exit 2). 이 판정은 Cloudflare 가 모든 경로를 403(error 1010)으로 주기 때문에 미인증 상태 코드가 아니라 OpenAPI <code>paths</code>로 한다. 그 뒤 남는 것은 <b>물리 마이크 50분</b>과 <b>독립 human voice-gain pack</b> 둘뿐이다.</td></tr>
-                  <tr><td>노트북 로컬 음성 스택 — faster-whisper STT + MeloTTS TTS</td><td><code>scripts/local-whisper-stt-server.py</code> · <code>scripts/start-local-whisper-stt.ps1</code> · <code>voice_stt_provider=local_whisper</code></td><td>2026-08-08 소유자 결정으로 음성 양쪽을 노트북 상주 로컬 모델로 정했다. TTS는 처음 Higgs로 잡았으나 연구/비상업 라이선스라 <code>config.py</code>가 운영에서 차단하고 있었고 그 가드를 푸는 건 법적 판단이라, 상업 사용이 허용된 <b>MeloTTS Korean(MIT)</b>으로 바꿔 가드 자체를 불필요하게 만들었다. Kokoro-82M은 Apache 2.0이지만 공식 <code>VOICES.md</code>에 <b>한국어가 없어</b> 탈락했다. 이전에는 로컬 STT 경로가 코드에 없었고 interim/final 스트리밍이 Deepgram 전용이었다. Higgs와 같은 loopback 사이드카를 추가해 오디오가 호스트를 벗어나지 않고 외부 STT 키도 필요 없다. <b>실측</b>: 저장소 합성 시드 8.72초에서 interim <code>9</code>·final <code>5</code>·word timestamp 12개 present, 전사는 원문과 한 글자 차이. 회귀 사이드카 <code>37/37</code>, API 전체 <code>908 passed</code>, gateway <code>58</code>, G7 checker <code>23</code>, ruff clean. 이 노트북은 CUDA는 보이지만 cuDNN 부재로 GPU 추론이 <b>네이티브 크래시</b>라 디바이스 확인을 자식 프로세스(<code>--self-check</code>)로 분리하고 CPU 폴백을 넣었다. cuDNN 9 설치는 소유자 판단으로 남겼다. MeloTTS는 CPU 정상 상태 RTF <code>0.27~0.28</code>(실시간 3.6배), <code>POST /tts</code> 200·WAV 350,566 bytes·3.61s, 빈 텍스트 422·미지 경로 404이며, <b>합성음을 로컬 STT가 완전 일치 전사</b>하는 왕복 검증을 통과했다(사이드카 16/16, API 914 passed). G7 체커의 <code>deepgram</code> 하드코딩도 운영 provider 허용목록으로 교정했고 선언/실제 불일치 차단은 유지한다. Higgs 운영 사용은 라이선스 가드가 남아 dev 전용이다.</td></tr>
+                  <tr><td>격리 NAS 프리뷰 · 회기 E2E 자동화</td><td><code>http://100.116.83.60:8088</code> / <code>vignette-e2e</code> 매일 04:30 KST / <a href="./ops/nas-preview-deployment-evidence-2026-08-07.md">배포 증거</a> / <a href="./ops/evidence/nas-preview-current-deploy-2026-08-07.json">기계 판독 증거</a></td><td>SHA <code>6030a677…c611</code>을 전용 Compose 프로젝트·포트·네트워크·named volume에 승격했다. localhost candidate browser E2E 108/108, health 3/3, OpenAPI 126·auth 401·G0~G8, postdeploy SSE→DB review를 통과했고 predeploy dump와 이전 exact images를 보존했다. 같은 NAS 평문 origin은 UUID 결함으로 24건 실패했으므로 현재 소스 수정 배포와 NAS-origin 재검증이 남았다. 자동화는 ACTIVE이며 material milestone+release gate+배포 SHA 변경 때만 프리뷰를 갱신한다. G7 외부 mic/provider/human 증거는 별도다.</td></tr>
+                  <tr><td>G7 외부 증거 3-artifact 동시 시간창 오케스트레이터</td><td><code>scripts/run-g7-external-proof-window.py</code> · <a href="./ops/outcome-os-g7-external-proof-readiness-2026-08-07.md">준비 문서</a></td><td>soak·runtime·topology 세 캡처를 같은 host의 공통 3,000초 시간창으로 실행하고 checker까지 잇는다. CLI는 동의·장치 없음, human pack 없음, 3,120초 미만, host 불일치를 전부 fail-closed하며 <code>--rehearse</code>는 마이크를 열지 않는다. 기존 Linux Compose gate를 보존한 채 Windows host Uvicorn+cloudflared topology mode를 추가해 detached-clean source/tool SHA와 PID/start/exe·command SHA/cwd·process/TCP high-water를 검증했고 runner/checker/topology 86/86을 통과했다. current source launcher도 local sidecar/provider/queue와 fresh PID provenance를 fail-closed로 연결했지만 아직 공개에 실행하지 않았다. <b>남은 선행 조건:</b> 공개 런타임은 119 paths 구버전이고 <code>/admin/voice-runtime</code>이 없으며 <code>/voice/health</code>는 OpenAI STT/TTS, local sidecar 9882/9883은 내려가 있다. API는 Git 없는 냉동 release cwd라 provenance gate도 닫혀 있다. clean committed source runtime으로 정렬한 뒤에만 <b>물리 마이크 50분</b>과 <b>독립 human voice-gain pack</b>을 수집한다.</td></tr>
+                  <tr><td>G7 external GATE · 최종 감사 정정</td><td><code>run-g7-external-proof-window.py</code> → <code>check-g7-external-proof.py</code></td><td><b>상태는 external GATE 유지.</b> 물리 마이크 전 코드 P0 3건은 완료됐다. runner 프로세스 exit는 canonical checker <code>exit 0</code>·<code>gate_closed=true</code>에 결속되고, browser Origin <code>vignette.chanpaca.net</code>은 API/WSS/admin/topology host <code>api-vignette.chanpaca.net</code>과 분리된 HTTPS allowlist로 검증되며, 세 artifact 교집합은 <code>≥3000s</code> + 120초 sampler margin으로 강제된다. Windows proof는 detached-clean HEAD/tree·runner/collector/checker script SHA·exact <code>psutil==6.1.1</code>을 pin한다. 공개 창에서는 legacy PID를 재사용하지 않고 API/cloudflared를 pinned executable/config와 stable release cwd에서 강제 재시작해 safe provenance receipt를 결속한다. 남은 것은 clean-source 실제 배포와 4-artifact 실증이다.</td></tr>
+                  <tr><td>G8 runtime REVALIDATION · 17:07 NAS 기준선</td><td><code>vignette-preview-20260807</code> · <code>run-outcome-os-release-agent.py</code></td><td><b>상태는 runtime REVALIDATION 유지.</b> active SHA <code>6030a677…c611</code>, API/Web <code>52e0…8b2d</code>/<code>6fdb…f215</code> exact running, previous <code>79ec…4450</code>/<code>c530…2f28</code> 보존. <code>api/web/db/proxy</code> 4개 running + <code>unless-stopped</code>, volume <code>vignette-preview-20260807_pgdata</code>, health 3/3·db/engine true·auth 401·OpenAPI 126 + G1~G8 routes·root/JS/CSS 200, helper/listener 0이다. dump는 <code>92ed…1570f</code> 960,970 bytes와 <code>726982…5d41c</code> 1,015,222 bytes. release agent는 DB dump/restore를 지원하지 않으므로 매 execute 직전 fresh dump SHA/size/TOC·DB identity를 별도 결속한다. 자동 rollback은 image/Compose/active-state뿐이고 migration/data restore는 별도 owner 승인이다. remote release root/Compose mode <code>0777</code> P1은 최소권한 preflight로 닫는다.</td></tr>
+                  <tr><td>노트북 로컬 음성 스택 — faster-whisper STT + MeloTTS TTS</td><td><code>scripts/local-whisper-stt-server.py</code> · <code>scripts/start-local-whisper-stt.ps1</code> · <code>voice_stt_provider=local_whisper</code></td><td>2026-08-08 소유자 결정으로 음성 양쪽을 노트북 상주 로컬 모델로 정했다. TTS는 처음 Higgs로 잡았으나 연구/비상업 라이선스라 <code>config.py</code>가 운영에서 차단하고 있었고 그 가드를 푸는 건 법적 판단이라, 상업 사용이 허용된 <b>MeloTTS Korean(MIT)</b>으로 바꿔 가드 자체를 불필요하게 만들었다. Kokoro-82M은 Apache 2.0이지만 공식 <code>VOICES.md</code>에 <b>한국어가 없어</b> 탈락했다. local Whisper는 현재 호스트의 cuDNN 부재를 반영해 <code>small/cpu-int8</code>를 운영 기본으로 고정했고, API health도 MeloTTS model을 실제 provider와 맞춰 보고한다. 합성 시드 8.72초에서 interim 9·final 5·word timestamp 12개, 한 글자 차이 전사를 확인했고 MeloTTS CPU RTF는 0.27~0.28, 합성음→local STT 왕복은 완전 일치했다. current 통합은 launcher/sidecar 80/80·G7 전체 166/166·API voice 71/71·API 전체 921·gateway 58을 통과했다. Higgs 운영 사용은 라이선스 가드가 남아 dev 전용이다.</td></tr>
                   <tr><td>비-secure origin 회기 리뷰 크래시 수정</td><td><code>apps/web/src/lib/uuid.ts</code> · <code>apps/web/e2e/insecure-context-uuid.spec.ts</code></td><td>격리 NAS 프리뷰(평문 HTTP·비-localhost)에서 회기 리뷰 라우트가 <code>crypto.randomUUID is not a function</code>으로 error boundary에 잡혔다. 이 API는 secure context 전용인데 제품 코드 18곳이 fallback 없이 호출했고 <code>RuptureRepairCard</code>는 렌더 시점 호출이라 화면 전체가 죽었다. 릴리스 게이트는 localhost 후보 스택에서만 돌아 미검출. <code>randomUuid()</code>로 통일하고 fallback도 <code>getRandomValues</code> 우선으로 예측 불가능성을 유지했다. 회귀 <code>6/6</code>(직접 호출 0건 검사 포함), typecheck·build 통과. <b>NAS 프리뷰에는 아직 미배포</b>이며 배포된 SHA <code>6030a677…c611</code>은 여전히 결함 빌드다.</td></tr>
                   <tr><td>공개 워치독 engine readiness 사각지대(해결)</td><td><code>scripts/watch-public-runtime.ps1</code> · <code>scripts/start-public-runtime.ps1</code> · <code>apps/api/engine_gateway/gateway.py</code></td><td>2026-08-07 22:0x KST 소유자 승인으로 9099를 재기동해 복구했다. 재기동 직후 <code>/ready?force=true</code> 200 <code>ok:true·detail:OK</code>, API 8001과 공개 <code>api-vignette.chanpaca.net</code> 모두 <code>status:ok·engine:true·engine_detail:OK</code>다. 원인은 16:06부터 상주한 9099 프로세스 하나였다(CLI·코드·cwd는 정상 — 동일 인자 직접 실행과 <code>EngineSession</code> 재현이 <code>"OK"</code>를 반환). 재발 방지 3건: (1) 워치독·기동 스크립트의 engine 판정을 <code>/health</code>(프로세스 liveness)에서 <code>/ready</code>(실제 생성)로 바꾸고 API 판정에 <code>engine</code>을 추가, shared secret 인스턴스용 토큰 헤더와 503 본문 로깅 포함. (2) 게이트웨이가 자식 <code>claude -p</code>의 stderr를 상시 드레인해(PIPE 미독 시 자식 블록도 차단) 실패 detail에 <code>exit</code>·stderr를 붙인다 — 실증: <code>empty engine response (error: unknown option '--vignette-nonexistent-flag-xyz')</code>. (3) 기동 시 게이트웨이 로그 회전, <code>Stop-UvicornByPort</code>에 <code>Name -like python*</code> 추가(호출자 자기 자신 종료 방지). 검증: <code>pytest engine_gateway</code> 58/58, 워치독 <code>-CheckOnly</code> healthy 5/5, 장애 재현(9299·<code>CLAUDE_BIN</code> 부재)에서 <code>/health</code>는 <code>ok:true</code>로 통과하고 <code>/ready</code>는 503으로 검출되어 워치독이 <code>unhealthy (1/3)</code> + 503 본문을 남겼다. <b>NAS용 9100(06:27 상주)은 실사용 세션 7개가 있어 미접촉</b>이라 게이트웨이 stderr 개선은 다음 재기동 때 반영된다.</td></tr>
                   <tr><td>G8 실제 receipt-bound image rollback</td><td><code>scripts/launch-nas-preview-g8-helpers.py</code> / <code>scripts/serve-nas-preview-rollback-executor.py</code> / <code>scripts/probe-nas-preview-g8-rollback.py</code> / <a href="./ops/nas-preview-g8-rollback-proof-runbook.md">런북</a> / <a href="./ops/evidence/nas-preview-g8-actual-rollback-2026-08-07.json">기계 판독 증거</a></td><td>격리 NAS에서 별도 executor(18149)·control-plane(8018) helper로 실제 image rollback 2회를 실행했다. receipt <code>nas-g8-723eeef2…</code>로 previous <code>79ec…4450</code>/<code>c530…2f28</code>, receipt <code>nas-g8-2738846c…</code>로 current <code>52e0…8b2d</code>/<code>6fdb…f215</code>를 활성화했다. release gate·approval 각각 2회 멱등, <code>audit.ci_lifecycle_event</code> rollback/executed 2건과 receipt id 결속, silent auto-promotion 0, HMAC journal 6-record 체인 검증, health 3/3·OpenAPI 126·auth 401·Web 200, helper 0·listener 0 복귀. helper 격리 계약은 image 상속 label baseline 대비 검증이며 fake-runner 37/37로 고정했다. <code>down</code>/<code>volume rm</code>/<code>prune</code> 미실행, 공개 런타임 미접촉.</td></tr>
@@ -1140,8 +1160,9 @@
                   <tr><td>Public OAuth start</td><td><code>/auth/config</code> + <code>/auth/login?provider=google</code></td><td>2026-06-30 복구 후 auth config 200, Google configured true, redirect URI <code>https://api-vignette.chanpaca.net/auth/callback</code>, dev-login disabled. Google login start는 GET 302와 <code>__Host-vignette_oauth_state</code> HttpOnly/Secure cookie를 반환한다. Authenticated public <code>/turn</code> proof는 owner storageState가 필요하다.</td></tr>
                   <tr><td>Persona auth boundary</td><td><code>GET /personas</code></td><td>2026-06-30 복구 후 public unauth <code>/personas</code>는 401 <code>not authenticated</code>를 반환한다.</td></tr>
                   <tr><td>Public login</td><td><code>auth.spec.ts --grep public login</code></td><td>1 passed</td></tr>
-                  <tr><td>Public runtime scripts</td><td><code>start/watch/boot-public-runtime*.ps1</code></td><td>PowerShell 5.1 parser 오류 0. 관리자·인증 제어면(<code>prod + db</code>)과 엔진 readiness를 분리하고, API 코드 배포는 <code>-ForceApiRestart -SkipEngineRestart -SkipWebRestart -SkipCloudflaredRestart</code>로 API만 교체한다. 2026-07-30 OAuth upsert hotfix 뒤 API PID <code>40992</code>, local/public <code>status=ok</code>, <code>environment=prod</code>, <code>db=true</code>, <code>engine=true</code>다.</td></tr>
-                  <tr><td>Public API health</td><td><code>http://127.0.0.1:8001/health</code> / <code>https://api-vignette.chanpaca.net/health</code></td><td>2026-07-30 최종 local/public 확인에서 <code>environment=prod</code>, <code>status=ok</code>, <code>db=true</code>, <code>engine=true</code>, <code>engine_detail=OK</code>다. 관리자·인증 제어면과 엔진 readiness를 분리했으며, 엔진 단독 장애는 API 재시작으로 전파되지 않는다. OAuth config는 200/configured true다.</td></tr>
+                  <tr><td>Public runtime scripts · source pin</td><td><code>start/watch/boot-public-runtime*.ps1</code> · <code>install-public-runtime-task.ps1</code> · <code>register-boot-task.ps1</code></td><td>PowerShell 5.1 parser 오류 0. detached-clean stable source, Git commit/tree, watchdog|boot/start script SHA를 runtime 검사·mutation 전에 검증하며 hidden VBS는 구조적으로 pin된 task만 trigger한다. 회귀는 provenance 11개를 포함한 combined 22/22·WSH syntax PASS. <b>실제 task migration은 아직 미완료</b>: watchdog과 로그온 task action이 shared worktree/legacy 인자를 가리켜 최신 5분 watchdog은 mutation 전에 exit하고 <code>LastTaskResult=1</code>이다. 사용자 승인 clean commit 뒤 동일 stable release root로 두 task를 재등록하고 action pin·result 0·로그온/reboot smoke를 확인해야 한다.</td></tr>
+                  <tr><td>Public API health</td><td><code>http://127.0.0.1:8001/health</code> / <code>https://api-vignette.chanpaca.net/health</code></td><td>2026-08-09 핸드오프 read-only 확인에서 local/public 모두 <code>status=ok</code>, <code>db=true</code>, <code>engine=true</code>다. DB container는 recovered named volume과 <code>unless-stopped</code>를 유지한다. 이는 source-pin task migration이나 G7 current-source 배포 완료 증거가 아니다.</td></tr>
+                  <tr><td>Public runtime 17:54 read-only snapshot</td><td><code>health + OpenAPI + voice + listeners + Scheduled Tasks</code></td><td>local/public health <code>status=ok·db=true·engine=true</code>, 공개 OpenAPI <code>119 paths</code>, <code>/admin/voice-runtime</code> 없음, <code>/voice/health</code> <code>openai/gpt-4o-transcribe</code> + <code>openai/gpt-4o-mini-tts</code>, local Whisper 9882·MeloTTS 9883 listener <code>0</code>. watchdog·로그온 task action은 여전히 legacy shared worktree이고 17:54 KST watchdog <code>LastTaskResult=1</code>이다. 이는 필수 pin 인자 부재로 mutation 전 fail-closed한 값이며 G7 current-source 배포 완료가 아니다.</td></tr>
                   <tr><td>Public/local/Tailnet login recovery</td><td><code>https://vignette.chanpaca.net/login</code> / <code>https://api-vignette.chanpaca.net/health</code> / <code>https://alpaca-home.taile93291.ts.net/login</code></td><td>2026-06-30 public web login HEAD 200, public API health 200, auth config 200, Google login start 302. Earlier Tailnet checks remain recorded separately; vnet DNS A records are still 0.</td></tr>
                   <tr><td>Local 5175 login</td><td><code>PLAYWRIGHT_BASE_URL=http://127.0.0.1:5175 auth.spec.ts</code></td><td>desktop/mobile passed</td></tr>
                   <tr><td>Learner/readiness E2E</td><td><code>learner.spec.ts + readiness.spec.ts desktop/mobile</code></td><td>14 passed</td></tr>
@@ -1181,7 +1202,7 @@ $env:E2E_PUBLIC_STORAGE_STATE=".\node_modules\.tmp\public-auth.json"
 powershell -NoProfile -ExecutionPolicy Bypass -File scripts\start-public-runtime.ps1</pre>
               </div>
               <div class="source-note"><b>닫은 항목(live 증거):</b> ① engine config 운영값(<code>claude_cli / 9099 / gateway-default</code>, durable, db). ② 상주 엔진풀 probe — 단일 session_id 2회 reused stream, TTFT 1667–4199ms, cost 누적 0.068→0.123. ③ 상주 엔진풀 RSS — gateway session 1개에서 <code>claude -p</code> child RSS 363.3MB, gateway RSS 16.2MB. ④ Postgres RLS/audit smoke 5 checks PASS. ⑤ turn cost telemetry — <code>app.turns</code> client_ai 13행에 provider/model/cost_usd 실적재(합 $1.22). ⑥ 레이아웃 시각 게이트 최신 9/9 + 2026-06-28 적대적 재검수 7/7 accept.</div>
-              <div class="source-note"><b>환경 제약으로 이 세션에서 못 닫는 항목(정직 표기):</b> 공개 Google OAuth 실제 <code>/turn</code>(OAuth start는 2026-06-30 재확인 완료, 실제 계정 storageState 필요) · 실배포 <code>infra/.env</code> owner-secret fill-in(<code>APP_DB_PASSWORD</code>, <code>OAUTH_GOOGLE_CLIENT_ID</code>, <code>OAUTH_GOOGLE_CLIENT_SECRET</code>, <code>OPENAI_API_KEY</code>, <code>SESSION_SECRET</code>) · <code>vnet.18ka.net</code>/<code>api-vnet.18ka.net</code> 공개 런타임(DNS A record 0, Cloudflare 18ka.net zone 권한 불일치, Google OAuth redirect URI 등록 필요) · 한신대 데이터/SSO 거버넌스(owner/기관 written evidence 필요) · G7 실제 Deepgram 운영 key·quota live interim/final, 기대 provider/model authenticated public WSS ready, 명시 동의 물리 마이크와 50분 양방향 soak · claude_cli↔Messages API 폴백 동일성 · 실제 Windows 재부팅 후 watchdog smoke · Phase 3 파일럿 게이트. owner 결정 7건은 2026-06-30 전건 확정됨. 운영 원칙상 가짜 증거로 DONE 표기하지 않는다. 전체 추적: <code>docs/ops/backlog-2026-06-26.md</code>(B1 구현 후속 · B2 환경제약 · B3 소유자결정 · B4 거버넌스).</div>
+              <div class="source-note"><b>환경 제약으로 이 세션에서 못 닫는 항목(정직 표기):</b> 공개 Google OAuth 실제 <code>/turn</code>(OAuth start는 2026-06-30 재확인 완료, 실제 계정 storageState 필요) · 실배포 <code>infra/.env</code> owner-secret fill-in(<code>APP_DB_PASSWORD</code>, <code>OAUTH_GOOGLE_CLIENT_ID</code>, <code>OAUTH_GOOGLE_CLIENT_SECRET</code>, <code>OPENAI_API_KEY</code>, <code>SESSION_SECRET</code>) · <code>vnet.18ka.net</code>/<code>api-vnet.18ka.net</code> 공개 런타임(DNS A record 0, Cloudflare 18ka.net zone 권한 불일치, Google OAuth redirect URI 등록 필요) · 한신대 데이터/SSO 거버넌스(owner/기관 written evidence 필요) · G7 current source 공개 배포, <code>local_whisper</code>/<code>melotts</code> provider/model ready 일치, authenticated public WSS, 명시 동의 물리 마이크와 50분 양방향 soak, 독립 human voice-gain pack · claude_cli↔Messages API 폴백 동일성 · 실제 Windows 재부팅 후 watchdog smoke · Phase 3 파일럿 게이트. owner 결정 7건은 2026-06-30 전건 확정됨. 운영 원칙상 가짜 증거로 DONE 표기하지 않는다. 전체 추적: <code>docs/ops/backlog-2026-06-26.md</code>(B1 구현 후속 · B2 환경제약 · B3 소유자결정 · B4 거버넌스).</div>
             </div>
             <div class="tab-panel" id="panel-decisions" role="tabpanel" aria-labelledby="tab-decisions" hidden>
               <div class="detail-head"><div><h3>윤찬 결정 상세 (전건 확정)</h3><p>람다가 단독으로 정하면 월권인 항목이었다. 2026-06-30 owner 결정으로 전건 확정됐고, 각 결정의 구현·실측은 후속 build/GATE로 남는다.</p></div><div class="mini-metrics"><span>결정 0개(전건 확정)</span><span>조건부 GO 사유</span></div></div>
diff --git a/docs/guides/local-development.md b/docs/guides/local-development.md
index 7affe70..983867a 100644
--- a/docs/guides/local-development.md
+++ b/docs/guides/local-development.md
@@ -87,15 +87,28 @@ powershell -NoProfile -ExecutionPolicy Bypass -File scripts\start-tailscale-runt
 공개 API 복구 스크립트는 `docs/ops/public-runtime-watchdog.md`가 runbook이다. 로컬 개발 서버와 별개로
 prod API 8001, web preview 5174, engine gateway 9099, cloudflared tunnel을 검사한다.
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\watch-public-runtime.ps1 -CheckOnly
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-public-runtime-task.ps1 -RunNow
-```
+- shared branch worktree의 watchdog/start script를 직접 실행하지 않는다. 승인된 clean commit의 detached release
+  worktree를 만들고, 그 root 내부 registrar에 `-StableSourceRoot`를 명시해 두 task를 승격한다.
 
-- Scheduled Task는 현재 Windows 사용자 기준 `AtLogOn` + 반복 watchdog이다. 사용자 로그인 전 headless boot service가 아니다.
-- secret은 task 인자에 넣지 않는다. API secret은 `apps/api/.env`, cloudflared/Claude CLI credential은 사용자 profile에 둔다.
+      $releaseRoot = 'D:\workspace\vignette-public-runtime-<commit>'
+      $bootRegistrar = Join-Path $releaseRoot 'scripts\register-boot-task.ps1'
+      & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $bootRegistrar -StableSourceRoot $releaseRoot
+      $watchdogInstaller = Join-Path $releaseRoot 'scripts\install-public-runtime-task.ps1'
+      & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $watchdogInstaller -StableSourceRoot $releaseRoot -IntervalMinutes 5
+
+- `VignettePublicRuntime`은 로그온 Docker/DB 복구, `VignettePublicRuntimeWatchdog`은 로그온+5분 반복 health/recovery다.
+- 두 task action은 release root와 Git commit/tree, boot 또는 watchdog SHA-256, start script SHA-256을 고정한다.
+  등록 뒤 action marker와 working directory를 읽어 검증하기 전에는 `RunNow`를 호출하지 않는다.
+- secret은 task 인자에 넣지 않는다. API secret은 stable release의 `apps/api/.env`, cloudflared/Claude CLI credential은
+  사용자 profile에 둔다. `.env` 내용을 console이나 evidence에 출력하지 않는다.
 - 아직 DNS가 없는 future host는 기본 검사에 넣지 않는다. `api-vnet.18ka.net`처럼 실제로 열린 뒤에만 `-AdditionalPublicHealthUrls`로 명시 추가한다.
-- 완료 판정은 parser/check-only가 아니라 실제 재부팅 또는 로그오프/로그온 뒤 `Get-ScheduledTaskInfo`, watchdog 로그의 `restart verified`, public health, 인증된 public `/turn` smoke까지 한 세트로 남겨야 한다.
+- `watch-public-runtime-hidden.vbs`는 source를 직접 실행하지 않고 pin marker를 검증한 등록 task만 trigger한다.
+- 완료 판정은 parser/check-only가 아니라 실제 재부팅 또는 로그오프/로그온 뒤 `Get-ScheduledTaskInfo`, stable release의
+  watchdog 로그, public health, process cwd/Git provenance, 인증된 public `/turn` smoke까지 한 세트로 남겨야 한다.
+- detached worktree 생성, `.env`/`node_modules` 준비, source pin 검증, read-only `-CheckOnly` 전체 명령은 runbook을 따른다.
+- G7 공개 증거 승격은 routine API-only 복구와 다르다. `-RequireFreshPublicProvenance` + `-ForceApiRestart`로
+  API와 exact-config cloudflared를 둘 다 새 PID로 교체하고 commit/tree·Python/cloudflared/config SHA와 safe receipt를
+  결속한다. 이 모드에서 `-SkipCloudflaredRestart`는 금지되며, 정확한 명령은 runbook의 G7 fresh 절을 따른다.
 
 ### 수동 기동(대안)
 
diff --git a/docs/guides/testing.md b/docs/guides/testing.md
index bfeb3a6..d2ac8f8 100644
--- a/docs/guides/testing.md
+++ b/docs/guides/testing.md
@@ -20,7 +20,7 @@ Vignette 저장소의 모든 검증 수단(백엔드 단위 테스트, 웹 타
 | API 타입 생성 체크 | `apps/web` | `npm run check:api-types` | 불필요 | 불필요 | 불필요 | 불필요 | 불필요 | pass |
 | 웹 타입체크 | `apps/web` | `npm run typecheck` | 불필요 | 불필요 | 불필요 | 불필요 | 불필요 | pass |
 | 웹 빌드 | `apps/web` | `npm run build` | 불필요 | 불필요 | 불필요 | 불필요 | 불필요 | pass |
-| Playwright E2E(전체) | `apps/web` | `npm run e2e` | **필요(+시드)** | **필요** | 자동기동 | 일부만 | **필요** | 현재 수집 610 tests / 44 files · 현 작업트리 전체 GREEN 미검증 |
+| Playwright E2E(전체) | `apps/web` | `npm run e2e` | **필요(+시드)** | **필요** | 자동기동 | 일부만 | **필요** | 현재 수집 614 tests / 44 files · 현 작업트리 전체 GREEN 미검증 |
 
 핵심 원칙: **단위 테스트(pytest)와 타입체크/빌드는 외부 서비스 없이 단독 실행된다.**
 **E2E만 풀스택(DB+API+웹+브라우저)을 요구한다.** 아래 각 절에서 근거와 절차를 설명한다.
@@ -271,7 +271,7 @@ VITE_API_BASE=http://127.0.0.1:8000 npm run e2e        # 프록시 대신 API 
 
 ### 3.6 실측 테스트 개수 (현재)
 
-2026-08-07 `npx playwright test --list` 기준 **현재 수집 610 tests / 44 files**다.
+2026-08-09 `npx playwright test --list` 기준 **현재 수집 614 tests / 44 files**다.
 이 숫자는 수집량이지 통과량이 아니다. 현 작업트리 전체 604개 완주는 아직 증거가 없으며,
 과거 전체 GREEN 기록과 이번 focused/release gate 결과를 구분해 적는다.
 
@@ -401,11 +401,11 @@ VITE_API_BASE=http://127.0.0.1:8000 npm run e2e        # 프록시 대신 API 
   ```powershell
   C:\Users\encep\AppData\Local\Programs\Python\Python311\python.exe -X utf8 `
     scripts\soak-public-voice-websocket.py --preflight-only `
-    --expected-stt-provider deepgram --expected-stt-model nova-3 `
-    --expected-tts-provider <승인된-provider> --expected-tts-model <승인된-model>
+    --expected-stt-provider local_whisper --expected-stt-model small `
+    --expected-tts-provider melotts --expected-tts-model melotts-korean
   ```
 
-  50분 full soak는 같은 기대값에 `--duration-seconds 3000`, `--microphone-device <명시-장치>`,
+  50분 유효 공통창 full soak는 같은 기대값에 `--duration-seconds 3120`, `--microphone-device <명시-장치>`,
   `--confirm-physical-capture`를 추가하고 사용자가 실행 직전에 물리 캡처에 명시 동의한 경우에만 실행한다.
 - 2026-08-07 G7 external-proof readiness: Session 첫 음성 사용은 서버 30일·원음 미보존 consent ledger가
   성공하기 전 `getUserMedia`와 voice WebSocket을 시작하지 않는다. controlled provider와 synthetic stream을
@@ -414,9 +414,15 @@ VITE_API_BASE=http://127.0.0.1:8000 npm run e2e        # 프록시 대신 API 
   runner/checker와 release gate contract **31 passed**, typecheck·API type
   contract·Ruff·py_compile을 통과했다. `soak-public-voice-websocket.py` v4, `/admin/voice-runtime`,
   `capture-g7-runtime-evidence.py`, `capture-g7-topology-evidence.py`, independent human-held-out evaluator를
-  `check-g7-external-proof.py`가 같은 public host·겹치는 50분 시간창으로 묶는다. 실제 마이크·운영 Deepgram·
-  실제 참가자 evidence는 없으므로 G7은 BUILD다. 상세는
+  `check-g7-external-proof.py`가 같은 public transport host·겹치는 50분 시간창으로 묶는다. 실제 마이크·운영
+  local provider·실제 참가자 evidence는 없으므로 G7은 external GATE다. 상세는
   `ops/outcome-os-g7-external-proof-readiness-2026-08-07.md`가 소유한다.
+- 2026-08-09 G7 external-proof P0: production runner exit를 canonical checker 0·`gate_closed=true`에 묶고,
+  browser Origin allowlist와 API/WSS/admin/topology host·scheme을 분리했다. capture 최소 3,120초와 세 runtime
+  artifact 공통 3,000초, detached-clean commit/tree·runner/collector/checker SHA·`psutil==6.1.1`, fresh
+  API/cloudflared PID provenance receipt를 fail-closed로 고정했다. runner/checker/topology 86/86,
+  launcher/sidecar 80/80, G7 통합 166/166, API 921, gateway 58을 통과했다. 이 수치는 실제 물리 마이크·human pack을
+  대체하지 않으므로 G7은 external GATE다.
 - 2026-08-07 G7/G8 시각 QA: 데스크톱·Pixel 5에서 focused **16/16**, typecheck·build·cosmetic-filter를
   통과했다. G8 승인 차단 이유를 `title` 의존에서 상시 문구·`aria-describedby`·semantic form/Enter 제출로
   바꾸고, G7 이벤트 최소 24×24px와 시간축 키보드 포커스를 수치 회귀로 고정했다. 상세는
diff --git a/docs/ops/backlog-2026-06-26.md b/docs/ops/backlog-2026-06-26.md
index e4d5d6d..42ab602 100644
--- a/docs/ops/backlog-2026-06-26.md
+++ b/docs/ops/backlog-2026-06-26.md
@@ -13,7 +13,7 @@
 > 선제 구축했고, 임상 문안·평가기준·골든셋 콘텐츠는 임상팀(구훈정·어유경) 외부 정의로 받는다.
 >
 > **Outcome & Alliance OS** — 2026-08-06 정식 전략 실행 트랙으로 승격했다. G0 Measurement Truth, G1
-> 현재 소스·실행 증거 재감사에서는 G0~G6이 internal DONE이다. G1 승격 prompt 1.2+read-skew/JSON 복구는 24/24 ready·방향 9/9·오류 0을 재확인했고, G0 census 29/29·위반 0, G4/G5 실제 API/DB/브라우저 폐루프, G6 safety metadata-only 최우선 runtime을 disposable clone에서 확인했다. G8은 2026-08-07 격리 NAS에서 실제 receipt-bound image rollback 2회(`nas-g8-723eeef2…`/`nas-g8-2738846c…`)를 executed lifecycle receipt로 실행해 DONE이다. 과거 clean release/NAS의 route·asset·auth·browser 증거는 배포 존재 이력으로 보존하지만 현재 소스의 완료 증거로 재사용하지 않는다. G7 Multimodal Alliance는 내부 구현 DONE과 외부 proof GATE를 분리하며 Deepgram key·quota live, expected provider/model authenticated public WSS, 명시 동의 물리 마이크·50분 soak, 독립 라벨 voice-gain benchmark와 운영 topology resource high-water를 추적한다. 운영 TTS는 OpenAI API `gpt-4o-mini-tts`로 고정하고 공식 앱 통합·출력 소유 근거와 AI 생성 음성 고지를 반영했다. G0~G8과
+> 현재 소스·실행 증거 재감사에서는 G0~G6이 internal DONE이다. G1 승격 prompt 1.2+read-skew/JSON 복구는 24/24 ready·방향 9/9·오류 0을 재확인했고, G0 census 29/29·위반 0, G4/G5 실제 API/DB/브라우저 폐루프, G6 safety metadata-only 최우선 runtime을 disposable clone에서 확인했다. G8의 실제 receipt-bound image rollback 2회(`nas-g8-723eeef2…`/`nas-g8-2738846c…`)는 executed lifecycle receipt로 완료됐지만, 같은 NAS SHA의 평문 origin 회기 E2E 24건 실패 때문에 UUID 수정 배포·NAS-origin 재검증 전까지 전체 상태는 runtime REVALIDATION이다. 과거 clean release/NAS의 route·asset·auth·browser 증거는 배포 존재 이력으로 보존하지만 현재 소스의 완료 증거로 재사용하지 않는다. G7 Multimodal Alliance는 내부 구현 DONE과 외부 proof GATE를 분리하며 current source 공개 배포, 운영 기본 `local_whisper`/`melotts` ready, authenticated public WSS, 명시 동의 물리 마이크·50분 soak, 독립 라벨 voice-gain benchmark와 운영 topology resource high-water를 추적한다. 외부 Deepgram/OpenAI adapter는 fallback으로 보존한다. G0~G8과
 > AOS-001~012는 `docs/TODO.md` I절에서 전건 추적하고, 상태는 SSOT 대시보드의 9개 계획 카드가 소유한다.
 > 이 얇은 백로그에는 그중 외부·환경 증거가 필요한 항목만 기존 B2/B4/Phase 3 게이트와 합쳐 유지한다.
 
@@ -24,6 +24,17 @@
 - [ ] **운영 티켓 자동 분류·처리 후속** — Claude Recipe headless 자동 수정 후보, 관리자 승인 후 이슈 등록·PR/작업
   스레드 생성, 처리 결과 audit trail 확장은 아직 설계/승인 필요. 담당 그룹 자동 배정·우선순위 escalation·raw/rollup
   보존기간 같은 운영 정책은 B3에서 이미 결정됨(수동 승인·미도입 고정). 자동 수정은 운영자 승인 전까지 실행하지 않는다.
+- [ ] **G8 clean-head 릴리스와 NAS-origin 재검증** — explicit clean-head mode와 source-only UUID gate는
+  unit 30/30·UUID 6/6으로 구현됐다. 2026-08-09 execute 두 번은 각각 archive CRLF와 session E2E에서
+  fail-closed되어 NAS mutation 0이었다. timezone 없는 `started_at`의 약 9시간 오차는 UTC/KST 계약, API 전체
+  921 passed, KST focused DB/browser 1/1로 수정했다. 사용자 승인 아래 새 clean commit의 HEAD/tree/archive를
+  결속한 뒤 격리 NAS preview에 승격해 실제 평문 origin의 전체 회기 E2E·SSE→DB review·student returned-practice를
+  0 failure로 재검증한다. fixture-only desktop/mobile 묶음은 16:49 KST 단일 120/120 뒤 dashboard 변경분 10/10을
+  따로 재검증해 current tree는 불변 110 + 최신 dashboard 10의 분할 GREEN이며, clean HEAD에서 exact 120을 다시
+  실행한다. 어느 쪽도 NAS runtime 증거를 대신하지 않는다. release agent는 DB dump/restore를 지원하지 않으므로 매 execute 직전 fresh custom dump의
+  SHA/size/TOC와 DB identity를 별도 증거로 결속한다. agent 자동 rollback은 image/Compose/active-state 범위뿐이며,
+  적용 migration/data restore는 별도 owner 승인을 받는다. remote release root/Compose mode `0777` P1도 최소권한
+  preflight로 닫는다. 이때만 G8 전체 DONE이 가능하다.
 
 > B1 완료 항목(학생 리뷰 1~5 척도 320px 반응형 재배치, 셸 구분선, 세션 종료 UX/다크테마, 아바타 SVG 리그 복귀와 래스터 비활성화, SEO/공유 카드, 레이아웃 정렬, 권한 위임,
 > 메일링, 아카이브 API, TTS voice map, 빈상태 레이아웃, 평가 실패 복구 UX, SSE 저장, live-coach 표면화,
@@ -34,10 +45,18 @@
 ## B2. 환경 제약 — 이 워크스테이션에서 증거 생산 불가
 
 - [ ] **공개 DB 계정·회기 복구 안정화** — 2026-08-07 18:26 KST owner 승인으로 recovered named volume을
-  `vignette-dev-db:55432`에 전환했다. public owner 집계 users 84, sessions 30, turns 705, Google 계정 16,
+  `vignette-dev-db:55432`에 전환했다. cutover owner 집계 users 84, sessions 30, turns 705, Google 계정 16,
   Google 소유 회기 30, orphan 0이며 health·engine·OAuth·watchdog가 정상이다. 기존 인증 세션은 복사하지
   않아 사용자는 Google 재로그인이 필요하다. current dump·old-original dump·전환 직전 rollback container를
   모두 보존하며, 실제 사용자의 소유 회기 확인과 자동 백업 운영화 전에는 제거하지 않는다.
+  2026-08-09 Docker Desktop 중단과 18:02:55 KST Docker Desktop UI의 active DB 직접 stop으로 `db=false`가
+  재발했지만 동일 recovered container/volume만 재기동했다. 현재 owner read-only 집계 users 356/sessions 193/
+  turns 726, Google users 16/Google-owned sessions 31이고 public db/engine true다. watchdog·로그온 boot의
+  detached-clean commit/tree/script SHA pin은 provenance 11개를 포함한 combined 22/22로 완료했지만 실제 task action은 아직
+  shared worktree다. watchdog 반복 실행은 필수 pin 인자 부재로 mutation 전에 exit해
+  `LastTaskResult=1`이며, 18:05 KST 복구 뒤 local/public health는 `status=ok·db=true·engine=true`, 공개 OpenAPI 119 paths,
+  `/voice/health` OpenAI STT/TTS, local voice sidecar listener 9882/9883은 0이다.
+  clean commit 뒤 두 task를 같은 stable release root로 재등록하기 전까지 자동복구는 fail-closed 상태다.
   상세: `docs/ops/public-db-recovery-rehearsal-2026-08-07.md`.
 - [ ] **DB 백업 운영화** — 검증형 one-shot custom dump와 실제 일회용 restore drill은 통과했다. 예약 실행,
   실패 알림, NAS/off-host 암호화 복제, restore drill 주기와 보존 정책을 운영 게이트로 남긴다.
@@ -53,7 +72,7 @@
 - [ ] **공개 Google OAuth 실제 `/turn` proof** — 로그인 가능한 계정으로 `storageState` 캡처 후 `E2E_PUBLIC_AUTH=1`
   + `chromium-public-auth` 1회 통과 필요. (소유자 지시로 보류 중.) 실행 명령은 대시보드 "다음 실행 명령" 참조.
 - [ ] **음성 캐스케이드 live** — 공개 G7 API route와 TLS 1.3 WSS handshake, 비인증 1008 차단, 로컬
-  synthetic short soak는 통과했다. Deepgram streaming adapter/interim/final/word timestamp, HMAC word pseudonym,
+  synthetic short soak는 통과했다. Deepgram/OpenAI fallback adapter와 운영 기본 `local_whisper`/`melotts`의 interim/final/word timestamp, HMAC word pseudonym,
   streaming 중 1초 동의 재검사, 공통 consent transaction lock, bounded queue/10MiB cap, 텍스트 보존·음성 재연결
   UX, `ready` provider/model 계약은 code/internal 완료다. actual-Postgres 동시 철회는 writer 대기→커밋 뒤 차단과
   timeline row 0, synthetic gold benchmark는 text-only 1-MAE `0.9533`→multimodal `0.9673`을 확인했다.
@@ -61,21 +80,42 @@
   마이크 열거·캡처 없이 검사한다. full soak는 `--confirm-physical-capture` 없이는 장치를 열기 전에 exit 3이다.
   Session 첫 음성 사용은 30일·원음 미보존 서버 동의 원장을 먼저 기록하며, 성공 전 `getUserMedia`와 voice
   WebSocket은 0회다. public runner v4의 turn별 interim/speech-final/latency, 관리자 single-worker runtime
-  high-water, exact image/container/cgroup/proc/Docker/TCP topology sampler, 30명/50회기/150축 독립 blind
-  human-held-out voice-gain evaluator와 이를 같은 public host·동시 50분 시간창으로 묶는 canonical checker까지
+  high-water, exact image/container/cgroup/proc/Docker/TCP topology sampler, held-out 30명 외 calibration split
+  참가자를 포함한 총 최소 31명/held-out 50회기/150축 독립 blind human-held-out voice-gain evaluator와 이를
+  같은 public host·동시 50분 시간창으로 묶는 canonical checker까지
   code/internal 준비를 마쳤다.
-  운영 TTS는 OpenAI API `gpt-4o-mini-tts`와 공식 Services Agreement 근거, 회기 전·중 AI 생성 음성 고지로
-  닫았다. 남은 범위: 실제 Deepgram 운영 key·quota의 live interim/final, 기대값과 일치하는 authenticated public
+  운영 TTS는 MeloTTS Korean(MIT) loopback으로 전환했고 외부 OpenAI adapter와 회기 전·중 AI 생성 음성 고지는
+  보존했다. 남은 범위: current source 공개 배포, `local_whisper`/`melotts`의 live interim/final과 기대값이 일치하는 authenticated public
   ready, 실행 직전 명시 동의 물리 마이크와 50분 양방향 soak, 독립 라벨 held-out/pilot voice-gain benchmark,
   같은 실행의 실제 worker·Uvicorn·OS·Cloudflare edge RSS/CPU/queue high-water. 네 artifact가
   `scripts/check-g7-external-proof.py` exit 0을 만들기 전에는 닫지 않는다.
+  2026-08-09 공개 재감사에서는 `/voice/health`가 OpenAI STT/TTS이고 9882/9883 listener가 0임을 확인했다.
+  current source의 `start-public-runtime.ps1`는 sidecar-before-API lifecycle, exact
+  `local_whisper/small/cpu-int8`·`melotts/melotts-korean` readiness, provider env, Uvicorn
+  `--ws websockets --ws-max-queue 4`를 fail-closed로 연결했다(launcher/sidecar 80/80, API voice 71/71).
+  공개 topology용 Windows host mode도 PID/start/exe·command SHA/cwd, RSS/CPU/handles/threads,
+  listener owner/conflict와 TCP high-water를 검증한다. 다만 아직 공개에
+  실행하지 않았고 현재 API는 Git metadata가 없는 냉동 release cwd라 provenance gate를 통과할 수 없다. current
+  committed repo 기반 public runtime 정렬을 먼저 닫기 전에는 물리 마이크 50분 창을 열지 않는다.
+  코드 P0는 완료됐다. runner exit는 canonical checker `exit 0`/`gate_closed=true`에 결속되고, browser Origin은
+  API/WSS/admin/topology host·scheme과 분리 검증되며, 실제 capture 최소 3,120초와 세 artifact 공통 overlap
+  `≥3000s`를 강제한다. Windows topology는 detached-clean HEAD/tree, runner/collector/checker SHA와 exact
+  `psutil==6.1.1`까지 pin한다. fresh launcher는 legacy API/exact-config cloudflared를 bounded 교체해 새
+  PID/start/exe/command SHA/cwd safe receipt를 만든다. runner/checker/topology 86/86, launcher/sidecar 80/80,
+  G7 통합 166/166을 통과했다. 이제 clean source 공개 배포·rehearse 전에는 물리 마이크를 열지 않는다.
   격리 NAS 프리뷰 `http://100.116.83.60:8088`은 전용 Compose 프로젝트·포트·네트워크·볼륨에 배포했고, 실제 브라우저 회기와
   review API 저장 축어록 2턴을 확인했다. 기존 프로젝트 중단·재생성 명령은 실행하지 않았다. 매일 04:30 KST `Vignette 회기 E2E 정기 검증`
-  (automation id `vignette-e2e`)은 ACTIVE이며 material milestone+release-only patch 결정성·manifest·clean-index·NAS preflight+배포 SHA 변경 때만 프리뷰를 갱신한다. current exact SHA `6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611`은 API/Web 새 이미지, 전체 browser E2E 108/108, OpenAPI 126, auth 401, G0~G8, postdeploy browser SSE→DB review와 health 3/3을 통과했다. 실제 receipt-bound rollback은 같은 프리뷰에서 별도 helper로 두 번 실행해 종료했다([런북](./nas-preview-g8-rollback-proof-runbook.md), [기계 판독 증거](./evidence/nas-preview-g8-actual-rollback-2026-08-07.json)). 첫 예약 실행 이력은 대기 상태다. 증거: [배포 증거](./nas-preview-deployment-evidence-2026-08-07.md),
-  [브라우저 증거](./evidence/nas-preview-live-turn-2026-08-07.png). 물리 마이크 캡처 미승인과 Deepgram 운영 키 부재는 해소되지 않았으므로 G7은 BUILD로 유지한다.
+  (automation id `vignette-e2e`)은 ACTIVE이며 material milestone+release gate·NAS preflight+배포 SHA 변경 때만 프리뷰를 갱신한다. 2026-08-07 SHA `6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611`은 API/Web 새 이미지, localhost candidate E2E 108/108, OpenAPI 126, auth 401, G0~G8, postdeploy browser SSE→DB review와 health 3/3을 통과했다. 같은 NAS 평문 origin에서는 UUID 결함으로 24건 실패했으므로 current source 배포 증거로 재사용하지 않는다. 실제 receipt-bound rollback은 같은 프리뷰에서 별도 helper로 두 번 실행해 종료했다([런북](./nas-preview-g8-rollback-proof-runbook.md), [기계 판독 증거](./evidence/nas-preview-g8-actual-rollback-2026-08-07.json)). 첫 예약 실행 이력은 대기 상태다. 증거: [배포 증거](./nas-preview-deployment-evidence-2026-08-07.md),
+  2026-08-09 17:07 KST current baseline은 exact API/Web `52e0…8b2d`/`6fdb…f215`, previous
+  `79ec…4450`/`c530…2f28` 보존, `api/web/db/proxy` 4개 running + `unless-stopped`, DB volume
+  `vignette-preview-20260807_pgdata`, health 3/3·db/engine true·auth 401·OpenAPI 126 + G1~G8 routes·root/JS/CSS
+  200, helper/listener 0이다. dump `92ed…1570f` 960,970 bytes와 `726982…5d41c` 1,015,222 bytes도 존재한다.
+  [브라우저 증거](./evidence/nas-preview-live-turn-2026-08-07.png). 명시 동의 물리 마이크와 독립 human voice-gain 증거는 아직 없으므로 G7은 external GATE로 유지한다.
 - [ ] **claude_cli ↔ Anthropic API live 동일성** — provider 라우팅·Anthropic `/v1/models` 탐색·지원 추론 강도·관리자 fail-closed 저장 경로는 구현 완료. 남은 범위는 연구팀/기관 `ANTHROPIC_API_KEY`를 게이트웨이 호스트에 주입한 live 응답·계량·오류 표면화 비교다. Claude CLI·Codex CLI(Terra/Medium)·Agy CLI(Gemini 3.6 Flash/High)는 로컬 live probe를 통과했다.
-- [ ] **재부팅 후 watchdog smoke** — `watch-public-runtime.ps1` + Scheduled Task가 재부팅 후 엔진/API/터널을 복구하고
-  public `/turn`이 통과하는지 실측. 재부팅 불가로 미실행(parser/check-only 경로는 확인). DNS 개통 후
+- [ ] **stable-source task 재등록 + 재부팅 후 watchdog smoke** — 사용자 승인 clean commit의 detached release
+  root에 watchdog·로그온 boot를 함께 재등록하고 action의 commit/tree/script SHA pin과 watchdog
+  `LastTaskResult=0`을 확인한 뒤, 실제 Windows 재부팅 후 엔진/API/터널 복구와 public `/turn`을 실측한다.
+  재부팅 불가로 미실행(parser·provenance 회귀는 확인). DNS 개통 후
   `api-vnet.18ka.net`은 `-AdditionalPublicHealthUrls`로 명시 추가. 상세: `docs/ops/public-runtime-watchdog.md`.
 
 ---
diff --git a/docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json b/docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json
new file mode 100644
index 0000000..857a60c
--- /dev/null
+++ b/docs/ops/evidence/g8-clean-head-material-milestone-2026-08-09.json
@@ -0,0 +1,33 @@
+{
+  "schema": "vignette.material-milestone.v1",
+  "milestone_id": "g8-clean-head-insecure-origin-runtime-2026-08-09",
+  "material": true,
+  "status": "ready_for_approved_clean_commit",
+  "goals": [
+    "G8"
+  ],
+  "evidence_refs": [
+    "git-head:94c681d450d2f3b4df55c036e333cd817db3f7fb",
+    "git-tree:d8d7f93fa0626e0dda475f0cc5b36734eaacceba",
+    "git-archive-sha256:6b1b15bd9a1ff2bdc6f0cfcd45a754688577c703c7a4a2e676bb9bad56cca3f7",
+    "tests:release-agent-clean-head-30",
+    "tests:insecure-context-uuid-6",
+    "tests:api-full-920",
+    "tests:session-timestamp-kst-db-browser-1",
+    "nas-predeploy-dump-sha256:72698232d132a8f848d81ff9d8602430e7e623c7646cc236cb39f978aab5d41c",
+    "nas-active-before:6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611"
+  ],
+  "release_gate": {
+    "dry_run": "passed_no_mutation",
+    "execute_attempts": 2,
+    "deployment_mutated": false,
+    "latest_candidate_e2e": {
+      "passed": 109,
+      "failed": 5
+    },
+    "source_only_gate_repair": "insecure-context UUID moved to isolated Vite gate; 6 passed",
+    "timestamp_fix": "UTC offset transport and KST review calendar date passed focused disposable DB and browser regression",
+    "remaining_blocker": "the verified dirty worktree changes are not yet represented by an approved clean Git commit",
+    "next_gate": "create an approved clean commit, recompute HEAD tree and archive identity, then rerun clean-head dry-run and execute"
+  }
+}
diff --git a/docs/ops/nas-preview-g8-rollback-proof-runbook.md b/docs/ops/nas-preview-g8-rollback-proof-runbook.md
index 5b7ddab..1aee8dd 100644
--- a/docs/ops/nas-preview-g8-rollback-proof-runbook.md
+++ b/docs/ops/nas-preview-g8-rollback-proof-runbook.md
@@ -44,7 +44,7 @@ sha256:52e0e816…8b2d  →  com.docker.compose.project=vignette-preview-2026080
 | 5 | `docker run` argv에 target project/service label을 넣지 않는다 | `assert_argv_isolation` + fake-runner 테스트 |
 | 6 | exact container name·ID와 `docker inspect` 증거를 남긴다 | `verify` 산출 evidence(`vignette.nas-preview-g8-helper-isolation.v1`) |
 
-테스트: `scripts/test_launch_nas_preview_g8_helpers.py` (31/31). 실제 실행 없이 argv 계약이
+테스트: `scripts/test_launch_nas_preview_g8_helpers.py` (37/37). 실제 실행 없이 argv 계약이
 고정되므로, 누가 나중에 target label을 주입하면 테스트가 먼저 깨진다.
 
 ### helper 하드닝 (argv에 고정)
diff --git a/docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md b/docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md
index 41021d4..5e4ea44 100644
--- a/docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md
+++ b/docs/ops/outcome-os-g7-external-proof-readiness-2026-08-07.md
@@ -2,7 +2,7 @@
 
 ## 판정
 
-G7은 계속 **BUILD**다. 이번 변경은 물리 마이크나 운영 Deepgram을 사용한 실증이 아니라,
+G7은 **내부 구현 DONE · external GATE**다. 이번 변경은 물리 마이크나 운영 provider를 사용한 실증이 아니라,
 외부 증거가 들어왔을 때 synthetic·preflight·짧은 probe로 잘못 닫히지 않도록 종료 게이트를
 실행 가능한 네 artifact 계약으로 만든 것이다.
 
@@ -23,9 +23,10 @@ G7은 계속 **BUILD**다. 이번 변경은 물리 마이크나 운영 Deepgram
 - Linux topology sampler는 exact Compose project/service, container ID, image digest, init PID,
   start/restart, cgroup path를 매 sample 전후 재검증한다. cgroup v2, `/proc`, parsed Docker stats,
   endpoint를 폐기한 host TCP queue/retransmit의 50분 high-water를 만들 수 있다.
-- 누적 high-water를 이번 실행의 부하로 오인하지 않도록 API worker와 대상 container는 증거 시작
-  120초 이내에 새로 시작된 동일 인스턴스여야 한다. checker가 시작 시각, PID/container ID와
-  네 artifact의 겹치는 시간창을 함께 묶어 이 조건을 fail-closed로 검증한다.
+- 누적 high-water를 이번 실행의 부하로 오인하지 않도록 Linux Compose API/container는 증거 시작
+  120초 이내의 동일 인스턴스여야 한다. Windows host mode는 detached-clean commit/tree, runner/collector/checker
+  SHA, `psutil==6.1.1`, 새 API/cloudflared PID/start/exe·command SHA/실제 cwd를 매 sample 전후 검증한다.
+  checker는 voice/runtime/topology 세 artifact의 **공통 시간창이 3,000초 이상**인지 재계산한다.
 - 독립 human-labeled held-out voice-gain 계약은 raw audio·transcript·synthetic pack을 거부하고,
   사전등록·동의·participant split·model artifact·blind independent labeler provenance를 요구한다.
   production gate는 30명/50회기/150 paired axis, ICC(A,1) 0.75, 선택적 κ 0.70, gain 0.01,
@@ -37,8 +38,9 @@ G7은 계속 **BUILD**다. 이번 변경은 물리 마이크나 운영 Deepgram
 
 ## 검증
 
-- API voice/G7 focused: `92 passed`.
-- external evidence runners/checkers와 release gate contract: `31 passed`; Ruff와 `py_compile` 통과.
+- API 전체 `921 passed`, gateway `58 passed`, API voice 통합 `71 passed`.
+- runner/checker/topology `86 passed`, public launcher/sidecar `80 passed`, G7 통합 `166 passed`;
+  Ruff·`py_compile`·PowerShell 5.1 parser·`git diff --check` 통과.
 - Web typecheck와 API type contract 통과.
 - `voice-success.spec.ts` chromium single-run `2/2` 통과. 동의 원장 응답을 의도적으로 지연한
   동안 `getUserMedia=0`, voice WebSocket `0`을 확인했고, 성공 뒤 각각 정확히 1회였다.
@@ -51,7 +53,8 @@ G7은 계속 **BUILD**다. 이번 변경은 물리 마이크나 운영 Deepgram
 
 ## 실제 종료 때 필요한 네 artifact
 
-1. `soak-public-voice-websocket.py` v4의 운영 Deepgram/OpenAI TTS·authenticated public WSS·
+1. `soak-public-voice-websocket.py` v4의 운영 기본값 `local_whisper`/`melotts`와 정확히 일치하는 ready metadata,
+   authenticated public WSS·
    명시 동의 물리 마이크 50분 양방향 `passed` evidence.
 2. 같은 시간창에 `capture-g7-runtime-evidence.py`로 얻은 관리자 endpoint worker/Uvicorn queue
    high-water evidence.
@@ -65,7 +68,7 @@ DONE으로 표시하지 않는다.
 
 ## 실행 오케스트레이터 (2026-08-08 추가)
 
-앞의 1~3번은 **같은 public host의 겹치는 시간창**이어야 하는데, 지금까지는 운영자가 세 명령을 따로
+앞의 1~3번은 **같은 public transport host의 공통 3,000초 시간창**이어야 하는데, 지금까지는 운영자가 세 명령을 따로
 띄우고 시계를 손으로 맞춰야 했다. 50분짜리 실행에서 한 번 어긋나면 처음부터 다시 해야 한다.
 `scripts/run-g7-external-proof-window.py`가 세 캡처를 **동시에** 시작하고, 전부 끝나면 human pack을
 더해 checker까지 그대로 돌린다.
@@ -74,22 +77,30 @@ DONE으로 표시하지 않는다.
 # 실제 실행 (물리 마이크 50분 + 사람 pack 필요)
 & $py -X utf8 -B scripts/run-g7-external-proof-window.py `
   --wss-url wss://api-vignette.chanpaca.net/voice/ws `
-  --origin https://api-vignette.chanpaca.net `
+  --origin https://vignette.chanpaca.net `
   --admin-runtime-url https://api-vignette.chanpaca.net/admin/voice-runtime `
-  --compose-project <project> --api-container <c> --api-image-digest sha256:... `
-  --caddy-container <c> --caddy-image-digest sha256:... `
+  --topology-mode windows-host --repo-root <detached-clean-root> `
+  --git-sha <commit> --git-tree-sha <tree> `
+  --runner-script-sha256 <sha> --collector-script-sha256 <sha> `
+  --checker-script-sha256 <sha> --psutil-version 6.1.1 `
+  --api-pid <pid> --api-executable-name python.exe --api-executable-sha256 <sha> `
+  --api-cwd <root\apps\api> --api-listen-port 8001 `
+  --cloudflared-pid <pid> --cloudflared-executable-name cloudflared.exe `
+  --cloudflared-executable-sha256 <sha> --cloudflared-cwd <root> `
   --microphone-device "<장치명>" --confirm-physical-capture `
+  --duration-seconds 3120 `
   --human-voice-gain <pack.json> --out-dir <증거디렉터리>
 ```
 
-게이트를 **약화시키지 않는다.** CLI로 실증한 fail-closed 경계 네 가지:
+게이트를 **약화시키지 않는다.** CLI로 실증한 주요 fail-closed 경계:
 
 | 시도 | 결과 |
 |---|---|
 | 동의·장치 없이 운영 실행 | `physical_microphone_consent_required`, exit 2 |
 | human pack 없이 운영 실행 | `human_voice_gain_pack_required`, exit 2 |
-| 50분 미만 시간창 | `production_window_too_short`, exit 2 |
-| 세 캡처의 host 불일치 | `hosts_must_match:[...]`, exit 2 |
+| 3,120초 미만 시간창 | `production_window_too_short`, exit 2 |
+| transport host/scheme 불일치 | `hosts_must_match` 또는 scheme 오류, exit 2 |
+| 허용되지 않은 browser Origin | query/원문을 반사하지 않는 Origin 오류, exit 2 |
 
 `--rehearse`는 마이크·사람 없이 **배관만** 확인하는 모드다. soak을 `--preflight-only`로 돌려 장치를
 열지 않고, 인자·경로·산출 파일까지 실제로 검증한다. 보고서의 `gate_closed`는 rehearse에서 **항상
@@ -122,5 +133,6 @@ has /admin/voice-runtime → False
 2. `--rehearse`로 배관을 확인한다.
 3. 동의 하 물리 마이크 50분 + human pack으로 실제 실행한다.
 
-기대 provider 기본값은 2026-08-08 결정에 맞춰 `local_whisper` / `melotts`다
-(근거: `../decisions/local-voice-stack.md`). 회귀는 `scripts/test_run_g7_external_proof_window.py` 20/20.
+기대 provider 기본값은 2026-08-08 결정에 맞춰 `local_whisper/small` / `melotts/melotts-korean`이다
+(근거: `../decisions/local-voice-stack.md`). runner 회귀는 37/37, G7 통합은 166/166이다. production exit 0은
+`checker_returncode == 0 && gate_closed is true`에 결속되며 rehearse는 성공해도 gate를 닫지 않는다.
diff --git a/docs/ops/public-runtime-watchdog.md b/docs/ops/public-runtime-watchdog.md
index 1306505..fc8e58a 100644
--- a/docs/ops/public-runtime-watchdog.md
+++ b/docs/ops/public-runtime-watchdog.md
@@ -1,134 +1,233 @@
 # Public Runtime Watchdog
 
-This runbook keeps the public Vignette runtime recoverable after Windows
-reboot, update, or process crash. It covers:
+이 runbook은 Windows 재부팅, 업데이트, 프로세스 장애 뒤 Vignette 공개 런타임을 복구한다.
 
-- engine gateway: `http://127.0.0.1:9099`
-- prod API: `http://127.0.0.1:8001`
-- Cloudflare tunnel for `https://api-vignette.chanpaca.net`
+- engine gateway: http://127.0.0.1:9099
+- prod API: http://127.0.0.1:8001
+- web preview: http://127.0.0.1:5174
+- Cloudflare tunnel: https://api-vignette.chanpaca.net
 
-## Secret Handling
+## 복구 소스 신뢰 계약
 
-Do not put secrets in scheduled task arguments.
+운영 task는 개발 중인 shared branch worktree를 실행하지 않는다. 아래 조건을 모두 만족하는 별도 release
+worktree만 허용한다.
 
-The scripts use the existing runtime locations:
+- 승인된 commit을 가리키는 detached HEAD
+- tracked/untracked non-ignored 변경 0
+- 설치 시 기록한 Git commit SHA와 tree SHA 일치
+- watchdog 또는 boot script SHA-256과 start-public-runtime.ps1 SHA-256 일치
+- task action의 working directory와 실행 script가 동일 release root
 
-- API secrets stay in `apps/api/.env`.
-- Cloudflared credentials stay under the current user's `.cloudflared` config.
-- Claude CLI OAuth/config stays in the current Windows user profile.
+watchdog은 이 증거를 health probe와 failcount 기록보다 먼저 다시 확인한다. boot recovery는 Docker, DB,
+프로세스 mutation보다 먼저 확인한다. 하나라도 달라지면 현재 운영 프로세스를 유지하고 nonzero로 종료한다.
 
-The installer creates a per-user interactive scheduled task. It starts at user
-logon and repeats as a watchdog. Fully unattended boot before any user logs in
-requires an operator-managed service account or Task Scheduler credential; do
-that in Windows, not by adding secrets to these scripts.
+API secret은 release root의 apps/api/.env에 두되 task 인자에는 넣지 않는다. 이 파일과 web node_modules,
+runtime log는 Git ignore 대상이다. Cloudflared와 Claude CLI credential은 현재 Windows 사용자 profile에 둔다.
 
-## Install Or Update
+## Stable Release 준비
 
-From the repo root:
+아래 작업은 승인된 clean commit이 생긴 뒤 단일 public mutation owner가 수행한다. 기존 release root를
+덮어쓰지 않는다.
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-public-runtime-task.ps1 -RunNow
-```
+    $ErrorActionPreference = 'Stop'
+    $repoRoot = 'D:\workspace\vignette'
+    $commit = (& git.exe -C $repoRoot rev-parse --verify HEAD).Trim()
+    if ($LASTEXITCODE -ne 0) { throw 'HEAD 조회 실패' }
+    $releaseRoot = "D:\workspace\vignette-public-runtime-$($commit.Substring(0, 12))"
+    if (Test-Path -LiteralPath $releaseRoot) { throw "release root already exists: $releaseRoot" }
 
-The installer is idempotent. Re-running it updates the same task:
+    & git.exe -C $repoRoot worktree add --detach $releaseRoot $commit
+    if ($LASTEXITCODE -ne 0) { throw 'detached release worktree 생성 실패' }
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-public-runtime-task.ps1 -IntervalMinutes 5
-```
+    Copy-Item -LiteralPath (Join-Path $repoRoot 'apps\api\.env') `
+      -Destination (Join-Path $releaseRoot 'apps\api\.env')
+    Push-Location (Join-Path $releaseRoot 'apps\web')
+    & npm.cmd ci
+    if ($LASTEXITCODE -ne 0) { throw 'release web npm ci 실패' }
+    Pop-Location
 
-Do not add future domains to the default watchdog until DNS and Cloudflare
-routing are live. For example, `api-vnet.18ka.net` is intentionally excluded
-from the default checks while that domain has no DNS. After a public domain is
-actually reachable, add it explicitly:
+    $dirty = @(& git.exe -C $releaseRoot status --porcelain=v1 --untracked-files=normal)
+    if ($LASTEXITCODE -ne 0 -or $dirty.Count -ne 0) {
+      throw "release source가 clean하지 않음: $($dirty -join '; ')"
+    }
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-public-runtime-task.ps1 `
-  -AdditionalPublicHealthUrls https://api-vnet.18ka.net/health
-```
+apps/api/.env의 내용을 console이나 evidence에 출력하지 않는다. 새 root에 node_modules와 .env를 준비한 뒤에도
+위 Git status 결과는 빈 값이어야 한다.
 
-Task name:
+## Task 설치 또는 승격
 
-```powershell
-VignettePublicRuntimeWatchdog
-```
+두 registrar 자체도 동일 stable release root에서 실행해야 한다. 다른 worktree의 registrar로 target만
+바꾸는 호출은 거부된다.
 
-## Manual Start
+    $bootRegistrar = Join-Path $releaseRoot 'scripts\register-boot-task.ps1'
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $bootRegistrar `
+      -StableSourceRoot $releaseRoot
+    if ($LASTEXITCODE -ne 0) { throw 'boot task 등록 실패' }
 
-Use this when you want to force a runtime restore immediately:
+    $watchdogInstaller = Join-Path $releaseRoot 'scripts\install-public-runtime-task.ps1'
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $watchdogInstaller `
+      -StableSourceRoot $releaseRoot `
+      -IntervalMinutes 5
+    if ($LASTEXITCODE -ne 0) { throw 'watchdog task 등록 실패' }
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\start-public-runtime.ps1
-```
+task 이름과 역할:
 
-`start-public-runtime.ps1`는 관리자·인증 제어면과 엔진을 분리한다. 이미
-`environment=prod`, `db=true`인 API와 정상 웹·터널은 유지하고, 엔진만 실패한 경우
-엔진만 복구한다. 엔진이 늦게 준비돼도 관리자·인증 API 기동을 막지 않는다.
+- VignettePublicRuntime: 사용자 로그온 시 Docker, PostgreSQL, runtime 복구
+- VignettePublicRuntimeWatchdog: 사용자 로그온 및 5분 반복 health/recovery
 
-API 코드 변경을 운영 프로세스에 반영할 때는 다른 표면을 유지한 채 API만 명시적으로 교체한다.
+둘 다 현재 사용자의 Interactive/Limited task다. 사용자 로그인 전 headless boot가 필요하면 별도
+operator-managed service account가 필요하며 credential을 script나 task arguments에 넣지 않는다.
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\start-public-runtime.ps1 `
-  -ForceApiRestart `
-  -SkipEngineRestart `
-  -SkipWebRestart `
-  -SkipCloudflaredRestart
-```
+### 등록 직후 source pin 검증
 
-## Health Checks
+RunNow 전에 action을 읽어 두 task가 같은 release root와 commit을 가리키는지 확인한다.
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\watch-public-runtime.ps1 -CheckOnly
-Invoke-RestMethod http://127.0.0.1:9099/health
-Invoke-RestMethod http://127.0.0.1:8001/health
-Invoke-RestMethod https://api-vignette.chanpaca.net/health
-```
+    $requirements = @{
+      VignettePublicRuntime = @(
+        '-StableSourceRoot',
+        '-ExpectedSourceCommit',
+        '-ExpectedSourceTree',
+        '-ExpectedBootScriptSha256',
+        '-ExpectedStartScriptSha256'
+      )
+      VignettePublicRuntimeWatchdog = @(
+        '-StableSourceRoot',
+        '-ExpectedSourceCommit',
+        '-ExpectedSourceTree',
+        '-ExpectedWatchdogSha256',
+        '-ExpectedStartScriptSha256'
+      )
+    }
 
-Optional extra public host check, only after the host resolves:
+    foreach ($taskName in $requirements.Keys) {
+      $task = Get-ScheduledTask -TaskName $taskName -ErrorAction Stop
+      $action = @($task.Actions)[0]
+      if ($action.WorkingDirectory -ne $releaseRoot) {
+        throw "$taskName working directory drift: $($action.WorkingDirectory)"
+      }
+      if ($action.Arguments.IndexOf($releaseRoot, [StringComparison]::OrdinalIgnoreCase) -lt 0) {
+        throw "$taskName release root pin 누락"
+      }
+      if ($action.Arguments.IndexOf($commit, [StringComparison]::OrdinalIgnoreCase) -lt 0) {
+        throw "$taskName commit pin 누락"
+      }
+      foreach ($marker in $requirements[$taskName]) {
+        if ($action.Arguments.IndexOf($marker, [StringComparison]::Ordinal) -lt 0) {
+          throw "$taskName action pin 누락: $marker"
+        }
+      }
+    }
 
-```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\watch-public-runtime.ps1 `
-  -CheckOnly `
-  -AdditionalPublicHealthUrls https://api-vnet.18ka.net/health
-```
+검증 뒤 watchdog만 명시적으로 실행하고 완료 상태를 확인한다.
 
-Optional real Claude CLI readiness smoke:
+    Start-ScheduledTask -TaskName VignettePublicRuntimeWatchdog
+    Get-ScheduledTaskInfo -TaskName VignettePublicRuntimeWatchdog
 
-```powershell
-Invoke-RestMethod http://127.0.0.1:9099/ready
-```
+LastTaskResult=0과 stable release root의 public-runtime-watchdog.failcount=0을 확인한다. health만 정상이라고
+새 source 배포가 완료된 것은 아니다. 공개 API process cwd, Git commit, OpenAPI, auth, voice provider/model,
+실제 session smoke까지 별도 배포 gate에서 확인한다.
 
-`/ready` can consume a small Claude budget because it performs a real generation.
+## 숨김 수동 Trigger
 
-## Logs And Task State
+watch-public-runtime-hidden.vbs는 source script를 직접 실행하지 않는다. 등록된 watchdog task action에
+StableSourceRoot, commit, tree, watchdog SHA, start SHA marker가 모두 있고 legacy Workspace action이 아님을
+검사한 뒤 Start-ScheduledTask만 호출한다.
 
-```powershell
-Get-ScheduledTask -TaskName VignettePublicRuntimeWatchdog
-Get-ScheduledTaskInfo -TaskName VignettePublicRuntimeWatchdog
-Get-Content .\public-runtime-watchdog.log -Tail 50
-Get-Content .\apps\api\engine.public.err.log -Tail 50
-Get-Content .\apps\api\api.public.err.log -Tail 50
-Get-Content .\cloudflared.public.err.log -Tail 50
-```
+    cscript.exe //nologo scripts\watch-public-runtime-hidden.vbs
 
-## Remove
+task가 아직 legacy shared-worktree action이면 VBS도 fail-closed한다.
 
-```powershell
-Unregister-ScheduledTask -TaskName VignettePublicRuntimeWatchdog -Confirm:$false
-```
+## Manual Source Recovery
 
-## Recovery Notes
+운영 code를 강제로 교체해야 할 때도 shared worktree의 start-public-runtime.ps1을 실행하지 않는다.
+위 pin 검증을 끝낸 release root의 script만 사용한다.
 
-If local health is good but public health fails, inspect the cloudflared process
-and `C:\Users\<user>\.cloudflared\vignette-config.yml`.
+    $startScript = Join-Path $releaseRoot 'scripts\start-public-runtime.ps1'
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $startScript `
+      -Workspace $releaseRoot `
+      -ForceApiRestart `
+      -SkipEngineRestart `
+      -SkipWebRestart `
+      -SkipCloudflaredRestart
+    if ($LASTEXITCODE -ne 0) { throw 'public API 교체 실패' }
 
-If engine health fails, verify that `claude` runs for the same Windows user that
-owns the scheduled task and that the user has completed Claude CLI login.
+start-public-runtime.ps1은 engine, API, web, tunnel을 분리해 이미 healthy인 표면을 유지한다. local Whisper와
+MeloTTS exact readiness가 닫히기 전에는 API restart gate를 통과하지 않는다.
 
-엔진 장애 중에도 `http://127.0.0.1:8001/health`의 `environment=prod`, `db=true`가
-유지되면 관리자·인증 제어면은 정상이다. 이때 watchdog은 API·웹·터널을 재시작하지
-않는다. 예약 작업 확인 기준은 `VignettePublicRuntime`의 `LastTaskResult=0`과
-`public-runtime-watchdog.failcount=0`이다.
+위 명령은 routine API-only 복구라 cloudflared를 유지하며 **G7 fresh topology 증거를 만들지 않는다**. G7 공개
+승격에서는 기존 API/cloudflared PID를 재사용하지 않고 아래 opt-in 계약을 사용한다. 실행 전에 detached-clean
+commit/tree와 Python/cloudflared/config SHA를 read-only로 고정하고, config ingress가 이미 exact public topology인지
+확인한다. 이 모드는 `-ForceApiRestart`가 필수이고 `-SkipCloudflaredRestart`를 허용하지 않는다.
 
-If API health fails with `environment`, `db`, or auth configuration errors,
-inspect `apps/api/.env`; do not copy secret values into scripts or task
-arguments.
+    $python = 'C:\Users\encep\AppData\Local\Programs\Python\Python311\python.exe'
+    $cloudflared = 'C:\Users\encep\AppData\Local\Microsoft\WinGet\Links\cloudflared.exe'
+    $cloudflaredConfig = 'C:\Users\encep\.cloudflared\vignette-config.yml'
+    $commit = (& git.exe -C $releaseRoot rev-parse --verify HEAD).Trim()
+    $tree = (& git.exe -C $releaseRoot rev-parse --verify 'HEAD^{tree}').Trim()
+    $pythonSha = (Get-FileHash -LiteralPath $python -Algorithm SHA256).Hash.ToLowerInvariant()
+    $cloudflaredSha = (Get-FileHash -LiteralPath $cloudflared -Algorithm SHA256).Hash.ToLowerInvariant()
+    $configSha = (Get-FileHash -LiteralPath $cloudflaredConfig -Algorithm SHA256).Hash.ToLowerInvariant()
+    $receipt = Join-Path (Join-Path 'D:\workspace\vignette-runtime-evidence' $commit) 'public-runtime-launch-provenance.json'
+
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $startScript `
+      -Workspace $releaseRoot `
+      -ForceApiRestart `
+      -SkipEngineRestart `
+      -SkipWebRestart `
+      -RequireFreshPublicProvenance `
+      -ExpectedSourceCommit $commit `
+      -ExpectedSourceTree $tree `
+      -ExpectedPythonSha256 $pythonSha `
+      -ExpectedCloudflaredSha256 $cloudflaredSha `
+      -ExpectedCloudflaredConfigSha256 $configSha `
+      -RuntimeProvenancePath $receipt
+    if ($LASTEXITCODE -ne 0) { throw 'fresh public provenance 승격 실패' }
+
+receipt에는 raw command line·config contents를 넣지 않고 PID/start/executable·command SHA/실제 cwd와 topology 입력만
+남긴다. 이 receipt의 PID와 pin을 `run-g7-external-proof-window.py --topology-mode windows-host`에 그대로 전달하고,
+공개 health·auth·OpenAPI·local provider ready를 확인하기 전에는 task action을 새 root로 재등록하지 않는다.
+
+## Read-only CheckOnly
+
+watchdog script를 직접 CheckOnly로 실행할 때도 task와 같은 pin을 모두 전달해야 한다.
+
+    $watchScript = Join-Path $releaseRoot 'scripts\watch-public-runtime.ps1'
+    $startScript = Join-Path $releaseRoot 'scripts\start-public-runtime.ps1'
+    $commit = (& git.exe -C $releaseRoot rev-parse --verify HEAD).Trim()
+    $tree = (& git.exe -C $releaseRoot rev-parse --verify 'HEAD^{tree}').Trim()
+    $watchSha = (Get-FileHash -LiteralPath $watchScript -Algorithm SHA256).Hash.ToLowerInvariant()
+    $startSha = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $watchScript `
+      -StableSourceRoot $releaseRoot `
+      -ExpectedSourceCommit $commit `
+      -ExpectedSourceTree $tree `
+      -ExpectedWatchdogSha256 $watchSha `
+      -ExpectedStartScriptSha256 $startSha `
+      -CheckOnly
+
+추가 public host는 DNS와 routing이 실제로 열린 뒤 installer의
+AdditionalPublicHealthUrls에 명시한다. 아직 열리지 않은 future host를 기본 probe에 넣어 restart loop를 만들지 않는다.
+
+## Health와 로그
+
+    Invoke-RestMethod http://127.0.0.1:9099/health
+    Invoke-RestMethod http://127.0.0.1:8001/health
+    Invoke-RestMethod https://api-vignette.chanpaca.net/health
+    Get-ScheduledTaskInfo -TaskName VignettePublicRuntimeWatchdog
+    Get-Content -LiteralPath (Join-Path $releaseRoot 'public-runtime-watchdog.log') -Tail 50
+    Get-Content -LiteralPath (Join-Path $releaseRoot 'apps\api\engine.public.err.log') -Tail 50
+    Get-Content -LiteralPath (Join-Path $releaseRoot 'apps\api\api.public.err.log') -Tail 50
+
+engine /ready는 실제 Claude generation을 수행할 수 있어 소량의 budget을 사용한다. shared secret으로 기동한
+gateway는 token header가 필요하다.
+
+엔진 장애 중에도 API health가 environment=prod, db=true이면 관리자와 인증 제어면은 유지한다. source
+provenance failure는 재시작으로 우회하지 말고 task action과 stable release를 다시 승격한다.
+
+## Task 제거
+
+제거는 명시적 운영 결정으로만 수행한다.
+
+    Unregister-ScheduledTask -TaskName VignettePublicRuntimeWatchdog -Confirm:$false
+    Unregister-ScheduledTask -TaskName VignettePublicRuntime -Confirm:$false
diff --git a/scripts/boot-public-runtime.ps1 b/scripts/boot-public-runtime.ps1
index 00cb83e..e149eb2 100644
--- a/scripts/boot-public-runtime.ps1
+++ b/scripts/boot-public-runtime.ps1
@@ -5,22 +5,121 @@
 #       start-public-runtime.ps1(-SkipWebRestart) 로 필요한 프로세스만 복구한다.
 # 멱등: 어느 단계든 이미 살아있으면 건드리지 않는다. 수동으로 여러 번 실행해도 안전.
 #
-# 등록(로그온 시 자동 실행, 숨김 창):
-#   powershell -NoProfile -ExecutionPolicy Bypass -File scripts\register-boot-task.ps1
-# 또는 수동:
-#   powershell -NoProfile -ExecutionPolicy Bypass -File scripts\boot-public-runtime.ps1
+# 등록(로그온 시 자동 실행, 숨김 창)은 register-boot-task.ps1가 생성하는
+# commit/tree/script SHA pin 인자를 사용한다. 핀 없는 직접 실행은 fail-closed한다.
 
 param(
-  [string]$Workspace = "D:\workspace\vignette",
+  [Parameter(Mandatory = $true)]
+  [string]$StableSourceRoot,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{40}$")]
+  [string]$ExpectedSourceCommit,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{40}$")]
+  [string]$ExpectedSourceTree,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{64}$")]
+  [string]$ExpectedBootScriptSha256,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{64}$")]
+  [string]$ExpectedStartScriptSha256,
   [string]$DockerDesktop = "C:\Program Files\Docker\Docker\Docker Desktop.exe",
   [int]$DaemonTimeoutSec = 360,
   [int]$DbTimeoutSec = 90,
   [int]$DbPort = 55432,
   [int]$ApiPort = 8001,
-  [string]$BootLog = "D:\workspace\vignette\boot-public-runtime.log"
+  [string]$BootLog = ""
 )
 
-$ErrorActionPreference = "Continue"  # 부트 스크립트는 끝까지 로깅하고 종료한다.
+$ErrorActionPreference = "Stop"
+
+$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
+$expectedBootScript = Join-Path $resolvedSourceRoot "scripts\boot-public-runtime.ps1"
+$startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
+
+function Invoke-GitText {
+  param([string[]]$Arguments)
+
+  $value = & git.exe -C $resolvedSourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
+}
+
+function Assert-StableSourceProvenance {
+  foreach ($requiredScript in @($expectedBootScript, $startScript)) {
+    if (-not (Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
+      throw "Pinned public runtime script not found at $requiredScript"
+    }
+  }
+
+  $runningBootScript = (Resolve-Path -LiteralPath $PSCommandPath).Path
+  if (-not [string]::Equals(
+      $runningBootScript,
+      (Resolve-Path -LiteralPath $expectedBootScript).Path,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Boot recovery is not executing from the pinned stable source root"
+  }
+
+  $gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
+  $resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+  if (-not [string]::Equals(
+      $resolvedGitRoot,
+      $resolvedSourceRoot,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Stable source root does not match its Git toplevel"
+  }
+
+  $symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+  $symbolicHeadExit = $LASTEXITCODE
+  if ($symbolicHeadExit -eq 0) {
+    throw "Stable source must be a detached HEAD, not branch $symbolicHead"
+  }
+  if ($symbolicHeadExit -ne 1) {
+    throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+  }
+
+  $actualCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
+  $actualTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+  if ($actualCommit -ne $ExpectedSourceCommit.ToLowerInvariant()) {
+    throw "Stable source commit drift: expected=$ExpectedSourceCommit actual=$actualCommit"
+  }
+  if ($actualTree -ne $ExpectedSourceTree.ToLowerInvariant()) {
+    throw "Stable source tree drift: expected=$ExpectedSourceTree actual=$actualTree"
+  }
+
+  $dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+  if ($dirty) {
+    throw "Stable source is not clean; refusing boot recovery"
+  }
+  foreach ($relativePath in @(
+    "scripts/boot-public-runtime.ps1",
+    "scripts/start-public-runtime.ps1"
+  )) {
+    Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
+  }
+
+  $actualBootScriptSha256 = (Get-FileHash -LiteralPath $expectedBootScript -Algorithm SHA256).Hash.ToLowerInvariant()
+  $actualStartScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+  if ($actualBootScriptSha256 -ne $ExpectedBootScriptSha256.ToLowerInvariant()) {
+    throw "Pinned boot script SHA256 drift"
+  }
+  if ($actualStartScriptSha256 -ne $ExpectedStartScriptSha256.ToLowerInvariant()) {
+    throw "Pinned start script SHA256 drift"
+  }
+}
+
+# Docker/DB/process mutation보다 먼저 stable source를 매 실행 재검증한다.
+Assert-StableSourceProvenance
+
+if (!$BootLog) {
+  $BootLog = Join-Path $resolvedSourceRoot "boot-public-runtime.log"
+}
+
+$ErrorActionPreference = "Continue"  # provenance 이후 부트 복구는 끝까지 로깅한다.
 
 function Write-BootLog([string]$Message) {
   $line = "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message
@@ -121,13 +220,10 @@ Write-BootLog "postgres 127.0.0.1:$DbPort up"
 if ((Test-ApiControlPlaneHealthy) -and (Test-EngineHealthy)) {
   Write-BootLog "control plane and engine already healthy; skipping runtime restart"
 } else {
-  $pub = Join-Path $Workspace "scripts\start-public-runtime.ps1"
-  if (-not (Test-Path -LiteralPath $pub)) {
-    Write-BootLog "ERROR: start-public-runtime.ps1 not found at $pub"
-    exit 1
-  }
   Write-BootLog "running start-public-runtime.ps1 -SkipWebRestart"
-  $out = & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $pub -SkipWebRestart 2>&1
+  $out = & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $startScript `
+    -Workspace $resolvedSourceRoot `
+    -SkipWebRestart 2>&1
   $out | ForEach-Object { Write-BootLog ("  pub> " + $_) }
   if ($LASTEXITCODE -ne 0) {
     Write-BootLog "ERROR: start-public-runtime.ps1 exit $LASTEXITCODE"
diff --git a/scripts/capture-g7-topology-evidence.py b/scripts/capture-g7-topology-evidence.py
index 612ab77..976e768 100644
--- a/scripts/capture-g7-topology-evidence.py
+++ b/scripts/capture-g7-topology-evidence.py
@@ -1,11 +1,14 @@
 #!/usr/bin/env python3
-"""Capture bounded, metadata-only G7 Linux/NAS topology evidence.
+"""Capture bounded, metadata-only G7 deployment topology evidence.
 
-The sampler pins two running Docker Compose containers (API and Caddy) to
-their exact project/service labels, container IDs, image IDs, init PIDs,
-start timestamps, and restart counts. Every sample validates those pins both
-before and after collection so a restart or image replacement cannot be
-reported as one continuous run.
+``linux_compose`` pins two running Docker Compose containers (API and Caddy)
+to their exact project/service labels, container IDs, image IDs, init PIDs,
+start timestamps, and restart counts. ``windows_host`` instead pins the
+Windows API and cloudflared processes to their PIDs, creation times,
+executable hashes, command-line hashes, working directories, and one Git SHA.
+Every sample validates its mode-specific pins both before and after collection
+so a restart or executable/source replacement cannot be reported as one
+continuous run.
 
 Only infrastructure counters are retained. Socket endpoints, request data,
 audio, transcripts, command output, and Cloudflare-internal queue data are
@@ -15,8 +18,10 @@ never written to evidence.
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import math
+import ntpath
 import os
 import re
 import shutil
@@ -25,17 +30,28 @@ import time
 from dataclasses import asdict, dataclass
 from datetime import UTC, datetime
 from decimal import Decimal, InvalidOperation
-from pathlib import Path, PurePosixPath
-from typing import Protocol, Sequence
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Any, Protocol, Sequence
 
 
 SCHEMA_VERSION = "vignette.g7-topology-evidence.v1"
+LINUX_COMPOSE_MODE = "linux_compose"
+WINDOWS_HOST_MODE = "windows_host"
+PINNED_PSUTIL_VERSION = "6.1.1"
 DEFAULT_INTERVAL_SECONDS = 1.0
 DEFAULT_SAMPLES = 10
 MAX_SAMPLES = 7_200
 MAX_INTERVAL_SECONDS = 60.0
 MAX_CAPTURE_WINDOW_SECONDS = 7_200.0
 _SHA256_PATTERN = re.compile(r"^sha256:[0-9a-f]{64}$")
+_RAW_SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
+_GIT_SHA_PATTERN = re.compile(r"^[0-9a-f]{40,64}$")
+_VERSION_PATTERN = re.compile(r"^[0-9]+(?:\.[0-9]+){2}(?:[A-Za-z0-9.+-]*)?$")
+_WINDOWS_PINNED_SCRIPTS = {
+    "runner": "scripts/run-g7-external-proof-window.py",
+    "collector": "scripts/capture-g7-topology-evidence.py",
+    "checker": "scripts/check-g7-external-proof.py",
+}
 _BYTE_VALUE_PATTERN = re.compile(r"^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]+)$")
 _RETRANSMIT_PATTERN = re.compile(r"(?:^|\s)retrans:(\d+)(?:/(\d+))?(?:\s|$)")
 _BYTE_MULTIPLIERS = {
@@ -67,6 +83,28 @@ class FileSource(Protocol):
     def list_names(self, path: str) -> list[str]: ...
 
 
+class WindowsSource(Protocol):
+    def dependency_version(self, name: str) -> str: ...
+
+    def read_identity(
+        self,
+        *,
+        pid: int,
+        role: str,
+        git_sha: str,
+    ) -> "WindowsProcessIdentity": ...
+
+    def read_metrics(self, *, pid: int, role: str) -> dict[str, int | float]: ...
+
+    def read_tcp_metrics(
+        self,
+        *,
+        api_pid: int,
+        cloudflared_pid: int,
+        api_listen_port: int,
+    ) -> dict[str, object]: ...
+
+
 class SubprocessCommandRunner:
     def available(self, command: str) -> bool:
         return shutil.which(command) is not None
@@ -104,6 +142,162 @@ class LocalFileSource:
             raise EvidenceFailure("required_linux_source_unreadable") from exc
 
 
+def _sha256_file(path: str, *, role: str) -> str:
+    digest = hashlib.sha256()
+    try:
+        with open(path, "rb") as handle:
+            while chunk := handle.read(1024 * 1024):
+                digest.update(chunk)
+    except OSError as exc:
+        raise EvidenceFailure(f"process_executable_unreadable:{role}") from exc
+    return digest.hexdigest()
+
+
+class LocalWindowsSource:
+    """Read process and TCP metadata through psutil without retaining endpoints."""
+
+    def __init__(self) -> None:
+        if os.name != "nt":
+            raise EvidenceFailure("windows_host_required")
+        try:
+            import psutil
+        except ImportError as exc:
+            raise EvidenceFailure("command_unavailable:psutil") from exc
+        self._psutil = psutil
+        self._processes: dict[int, Any] = {}
+
+    def dependency_version(self, name: str) -> str:
+        if name != "psutil":
+            raise EvidenceFailure(f"runtime_dependency_unknown:{name}")
+        version = getattr(self._psutil, "__version__", None)
+        if not isinstance(version, str) or not version:
+            raise EvidenceFailure("psutil_version_unreadable")
+        return version
+
+    def _process(self, pid: int, *, role: str):
+        cached = self._processes.get(pid)
+        if cached is not None:
+            return cached
+        try:
+            process = self._psutil.Process(pid)
+        except (self._psutil.NoSuchProcess, self._psutil.AccessDenied) as exc:
+            raise EvidenceFailure(f"process_unreadable:{role}") from exc
+        self._processes[pid] = process
+        return process
+
+    def read_identity(
+        self,
+        *,
+        pid: int,
+        role: str,
+        git_sha: str,
+    ) -> "WindowsProcessIdentity":
+        process = self._process(pid, role=role)
+        try:
+            with process.oneshot():
+                executable_path = process.exe()
+                executable_name = process.name()
+                cwd = process.cwd()
+                started_epoch = process.create_time()
+                command_line = process.cmdline()
+        except (
+            self._psutil.NoSuchProcess,
+            self._psutil.AccessDenied,
+            self._psutil.ZombieProcess,
+            OSError,
+        ) as exc:
+            raise EvidenceFailure(f"process_identity_unreadable:{role}") from exc
+        if not executable_path or not executable_name or not cwd or not command_line:
+            raise EvidenceFailure(f"process_identity_incomplete:{role}")
+        command_line_sha256 = hashlib.sha256(
+            "\0".join(command_line).encode("utf-8", errors="strict")
+        ).hexdigest()
+        return WindowsProcessIdentity(
+            role=role,
+            pid=pid,
+            started_at=datetime.fromtimestamp(started_epoch, UTC)
+            .isoformat()
+            .replace("+00:00", "Z"),
+            executable_name=executable_name,
+            executable_sha256=_sha256_file(executable_path, role=role),
+            command_line_sha256=command_line_sha256,
+            git_sha=git_sha,
+            cwd=ntpath.normpath(cwd),
+        )
+
+    def read_metrics(self, *, pid: int, role: str) -> dict[str, int | float]:
+        process = self._process(pid, role=role)
+        try:
+            with process.oneshot():
+                memory = process.memory_info()
+                cpu = process.cpu_times()
+                cpu_percent = process.cpu_percent(interval=None)
+                handles = process.num_handles()
+                threads = process.num_threads()
+        except (
+            self._psutil.NoSuchProcess,
+            self._psutil.AccessDenied,
+            self._psutil.ZombieProcess,
+            OSError,
+        ) as exc:
+            raise EvidenceFailure(f"process_metrics_unreadable:{role}") from exc
+        peak_rss = getattr(memory, "peak_wset", None)
+        if peak_rss is None:
+            raise EvidenceFailure(f"process_peak_rss_unavailable:{role}")
+        return {
+            "rss_bytes": int(memory.rss),
+            "peak_rss_bytes": int(peak_rss),
+            "cpu_time_seconds": float(cpu.user + cpu.system),
+            "cpu_percent": float(cpu_percent),
+            "handles": int(handles),
+            "threads": int(threads),
+        }
+
+    def read_tcp_metrics(
+        self,
+        *,
+        api_pid: int,
+        cloudflared_pid: int,
+        api_listen_port: int,
+    ) -> dict[str, object]:
+        try:
+            connections = self._psutil.net_connections(kind="tcp")
+        except (self._psutil.AccessDenied, OSError) as exc:
+            raise EvidenceFailure("windows_tcp_unreadable") from exc
+        roles = {"api": api_pid, "cloudflared": cloudflared_pid}
+        processes: dict[str, dict[str, int]] = {
+            role: {"connections": 0, "established": 0, "listeners": 0}
+            for role in roles
+        }
+        owned_listener_count = 0
+        conflicting_listener_count = 0
+        for connection in connections:
+            pid = connection.pid
+            status = str(connection.status).upper()
+            for role, role_pid in roles.items():
+                if pid == role_pid:
+                    processes[role]["connections"] += 1
+                    if status == "ESTABLISHED":
+                        processes[role]["established"] += 1
+                    if status == "LISTEN":
+                        processes[role]["listeners"] += 1
+            local = connection.laddr
+            local_port = getattr(local, "port", None)
+            if status == "LISTEN" and local_port == api_listen_port:
+                if pid == api_pid:
+                    owned_listener_count += 1
+                else:
+                    conflicting_listener_count += 1
+        return {
+            "processes": processes,
+            "host_tcp": {"connections": len(connections)},
+            "api_listener": {
+                "port": api_listen_port,
+                "owned_listener_count": owned_listener_count,
+                "conflicting_listener_count": conflicting_listener_count,
+            },
+        }
+
 @dataclass(frozen=True, slots=True)
 class CaptureConfig:
     compose_project: str
@@ -120,6 +314,29 @@ class CaptureConfig:
     cgroup_root: str = "/sys/fs/cgroup"
 
 
+@dataclass(frozen=True, slots=True)
+class WindowsHostConfig:
+    public_host: str
+    repo_root: str
+    git_sha: str
+    git_tree_sha: str
+    runner_script_sha256: str
+    collector_script_sha256: str
+    checker_script_sha256: str
+    psutil_version: str
+    api_pid: int
+    api_executable_name: str
+    api_executable_sha256: str
+    api_cwd: str
+    api_listen_port: int
+    cloudflared_pid: int
+    cloudflared_executable_name: str
+    cloudflared_executable_sha256: str
+    cloudflared_cwd: str
+    samples: int = DEFAULT_SAMPLES
+    interval_seconds: float = DEFAULT_INTERVAL_SECONDS
+
+
 @dataclass(frozen=True, slots=True)
 class ContainerIdentity:
     role: str
@@ -134,6 +351,18 @@ class ContainerIdentity:
     cgroup_path: str
 
 
+@dataclass(frozen=True, slots=True)
+class WindowsProcessIdentity:
+    role: str
+    pid: int
+    started_at: str
+    executable_name: str
+    executable_sha256: str
+    command_line_sha256: str
+    git_sha: str
+    cwd: str
+
+
 def utc_now() -> str:
     return datetime.now(UTC).isoformat().replace("+00:00", "Z")
 
@@ -194,6 +423,285 @@ def validate_config(config: CaptureConfig) -> None:
             raise EvidenceFailure(code)
 
 
+def _windows_path(value: object, *, code: str) -> PureWindowsPath:
+    cleaned = _clean_identifier(value, code=code)
+    path = PureWindowsPath(cleaned)
+    if not path.is_absolute() or ".." in path.parts:
+        raise EvidenceFailure(code)
+    return path
+
+
+def validate_windows_config(config: WindowsHostConfig) -> None:
+    _clean_identifier(config.public_host, code="public_host_invalid")
+    repo_root = _windows_path(config.repo_root, code="repo_root_invalid")
+    api_cwd = _windows_path(config.api_cwd, code="api_cwd_invalid")
+    cloudflared_cwd = _windows_path(
+        config.cloudflared_cwd, code="cloudflared_cwd_invalid"
+    )
+    for cwd, code in (
+        (api_cwd, "api_cwd_outside_repo"),
+        (cloudflared_cwd, "cloudflared_cwd_outside_repo"),
+    ):
+        if not cwd.is_relative_to(repo_root):
+            raise EvidenceFailure(code)
+    for value, code in (
+        (config.git_sha, "git_sha_invalid"),
+        (config.git_tree_sha, "git_tree_sha_invalid"),
+    ):
+        if not _GIT_SHA_PATTERN.fullmatch(value.lower()):
+            raise EvidenceFailure(code)
+    for digest, code in (
+        (config.runner_script_sha256, "runner_script_sha256_invalid"),
+        (config.collector_script_sha256, "collector_script_sha256_invalid"),
+        (config.checker_script_sha256, "checker_script_sha256_invalid"),
+    ):
+        if not _RAW_SHA256_PATTERN.fullmatch(digest.lower()):
+            raise EvidenceFailure(code)
+    if (
+        not _VERSION_PATTERN.fullmatch(config.psutil_version)
+        or config.psutil_version != PINNED_PSUTIL_VERSION
+    ):
+        raise EvidenceFailure("psutil_version_invalid")
+    for pid, code in (
+        (config.api_pid, "api_pid_invalid"),
+        (config.cloudflared_pid, "cloudflared_pid_invalid"),
+    ):
+        if isinstance(pid, bool) or not isinstance(pid, int) or pid <= 0:
+            raise EvidenceFailure(code)
+    if config.api_pid == config.cloudflared_pid:
+        raise EvidenceFailure("process_targets_not_distinct")
+    for name, code in (
+        (config.api_executable_name, "api_executable_name_invalid"),
+        (
+            config.cloudflared_executable_name,
+            "cloudflared_executable_name_invalid",
+        ),
+    ):
+        cleaned = _clean_identifier(name, code=code)
+        if PureWindowsPath(cleaned).name != cleaned:
+            raise EvidenceFailure(code)
+    for digest, code in (
+        (config.api_executable_sha256, "api_executable_sha256_invalid"),
+        (
+            config.cloudflared_executable_sha256,
+            "cloudflared_executable_sha256_invalid",
+        ),
+    ):
+        if not _RAW_SHA256_PATTERN.fullmatch(digest.lower()):
+            raise EvidenceFailure(code)
+    if not 1 <= config.api_listen_port <= 65_535:
+        raise EvidenceFailure("api_listen_port_invalid")
+    if not 1 <= config.samples <= MAX_SAMPLES:
+        raise EvidenceFailure("sample_count_out_of_bounds")
+    if not math.isfinite(config.interval_seconds) or not (
+        0.05 <= config.interval_seconds <= MAX_INTERVAL_SECONDS
+    ):
+        raise EvidenceFailure("sample_interval_out_of_bounds")
+    if (config.samples - 1) * config.interval_seconds > MAX_CAPTURE_WINDOW_SECONDS:
+        raise EvidenceFailure("capture_window_out_of_bounds")
+
+
+def _normalized_windows_path(value: str) -> str:
+    return ntpath.normcase(ntpath.normpath(value))
+
+
+def _read_git_sha(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+) -> str:
+    value = runner.run(
+        ["git", "-C", config.repo_root, "rev-parse", "--verify", "HEAD"]
+    ).strip()
+    if not _GIT_SHA_PATTERN.fullmatch(value.lower()):
+        raise EvidenceFailure("git_sha_unreadable")
+    if value.lower() != config.git_sha.lower():
+        raise EvidenceFailure("git_sha_drift")
+    return value.lower()
+
+
+def _sha256_evidence_script(repo_root: str, relative_path: str, *, role: str) -> str:
+    path = Path(repo_root, *PurePosixPath(relative_path).parts)
+    digest = hashlib.sha256()
+    try:
+        with path.open("rb") as handle:
+            while chunk := handle.read(1024 * 1024):
+                digest.update(chunk)
+    except OSError as exc:
+        raise EvidenceFailure(f"evidence_script_unreadable:{role}") from exc
+    return digest.hexdigest()
+
+
+def _expected_script_sha256(config: WindowsHostConfig, role: str) -> str:
+    if role == "runner":
+        return config.runner_script_sha256.lower()
+    if role == "collector":
+        return config.collector_script_sha256.lower()
+    if role == "checker":
+        return config.checker_script_sha256.lower()
+    raise EvidenceFailure(f"evidence_script_role_invalid:{role}")
+
+
+def read_windows_source_provenance(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+) -> dict[str, object]:
+    """Observe and enforce one detached, tracked-clean source/toolchain pin."""
+
+    git_sha = _read_git_sha(config, runner)
+    branch = runner.run(
+        ["git", "-C", config.repo_root, "rev-parse", "--abbrev-ref", "HEAD"]
+    ).strip()
+    if branch != "HEAD":
+        raise EvidenceFailure("git_head_not_detached")
+    tracked_status = runner.run(
+        [
+            "git",
+            "-C",
+            config.repo_root,
+            "status",
+            "--porcelain=v1",
+            "--untracked-files=no",
+        ]
+    )
+    if tracked_status.strip():
+        raise EvidenceFailure("git_tracked_worktree_dirty")
+    git_tree_sha = runner.run(
+        ["git", "-C", config.repo_root, "rev-parse", "--verify", "HEAD^{tree}"]
+    ).strip().lower()
+    if not _GIT_SHA_PATTERN.fullmatch(git_tree_sha):
+        raise EvidenceFailure("git_tree_sha_unreadable")
+    if git_tree_sha != config.git_tree_sha.lower():
+        raise EvidenceFailure("git_tree_sha_drift")
+
+    scripts: dict[str, str] = {}
+    for role, relative_path in _WINDOWS_PINNED_SCRIPTS.items():
+        digest = _sha256_evidence_script(config.repo_root, relative_path, role=role)
+        if digest != _expected_script_sha256(config, role):
+            raise EvidenceFailure(f"evidence_script_sha256_drift:{role}")
+        scripts[role] = digest
+
+    psutil_version = source.dependency_version("psutil")
+    if psutil_version != config.psutil_version:
+        raise EvidenceFailure("psutil_version_drift")
+    return {
+        "detached_head": True,
+        "tracked_clean": True,
+        "git_sha": git_sha,
+        "git_tree_sha": git_tree_sha,
+        "script_sha256": scripts,
+        "runtime_dependencies": {"psutil": psutil_version},
+    }
+
+
+def validate_windows_source_provenance(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+    baseline: dict[str, object],
+) -> None:
+    current = read_windows_source_provenance(config, runner, source)
+    if current != baseline:
+        raise EvidenceFailure("windows_source_provenance_drift")
+
+
+def _expected_windows_target(
+    config: WindowsHostConfig,
+    role: str,
+) -> tuple[int, str, str, str]:
+    if role == "api":
+        return (
+            config.api_pid,
+            config.api_executable_name,
+            config.api_executable_sha256,
+            config.api_cwd,
+        )
+    if role == "cloudflared":
+        return (
+            config.cloudflared_pid,
+            config.cloudflared_executable_name,
+            config.cloudflared_executable_sha256,
+            config.cloudflared_cwd,
+        )
+    raise EvidenceFailure("windows_process_role_invalid")
+
+
+def _validate_windows_target(
+    config: WindowsHostConfig,
+    target: WindowsProcessIdentity,
+) -> None:
+    pid, executable_name, executable_sha256, cwd = _expected_windows_target(
+        config, target.role
+    )
+    if target.pid != pid:
+        raise EvidenceFailure(f"process_pid_mismatch:{target.role}")
+    if target.executable_name.casefold() != executable_name.casefold():
+        raise EvidenceFailure(f"process_executable_name_mismatch:{target.role}")
+    if target.executable_sha256.lower() != executable_sha256.lower():
+        raise EvidenceFailure(f"process_executable_sha256_mismatch:{target.role}")
+    if not _RAW_SHA256_PATTERN.fullmatch(target.command_line_sha256.lower()):
+        raise EvidenceFailure(f"process_command_line_sha256_invalid:{target.role}")
+    if target.git_sha.lower() != config.git_sha.lower():
+        raise EvidenceFailure(f"process_git_sha_mismatch:{target.role}")
+    if _normalized_windows_path(target.cwd) != _normalized_windows_path(cwd):
+        raise EvidenceFailure(f"process_cwd_mismatch:{target.role}")
+    try:
+        started_at = datetime.fromisoformat(target.started_at.replace("Z", "+00:00"))
+    except ValueError as exc:
+        raise EvidenceFailure(f"process_started_at_invalid:{target.role}") from exc
+    if started_at.tzinfo is None:
+        raise EvidenceFailure(f"process_started_at_invalid:{target.role}")
+    if started_at.astimezone(UTC) > datetime.now(UTC):
+        raise EvidenceFailure(f"process_started_at_future:{target.role}")
+
+
+def pin_windows_targets(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+) -> dict[str, WindowsProcessIdentity]:
+    git_sha = _read_git_sha(config, runner)
+    targets: dict[str, WindowsProcessIdentity] = {}
+    for role in ("api", "cloudflared"):
+        pid, _, _, _ = _expected_windows_target(config, role)
+        target = source.read_identity(pid=pid, role=role, git_sha=git_sha)
+        _validate_windows_target(config, target)
+        targets[role] = target
+    if targets["api"].pid == targets["cloudflared"].pid:
+        raise EvidenceFailure("process_targets_not_distinct")
+    return targets
+
+
+def validate_windows_pins(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+    targets: dict[str, WindowsProcessIdentity],
+) -> None:
+    git_sha = _read_git_sha(config, runner)
+    for role in ("api", "cloudflared"):
+        baseline = targets[role]
+        current = source.read_identity(pid=baseline.pid, role=role, git_sha=git_sha)
+        _validate_windows_target(config, current)
+        for field, code in (
+            ("started_at", "process_start_drift"),
+            ("executable_sha256", "process_executable_drift"),
+            ("command_line_sha256", "process_command_line_drift"),
+            ("cwd", "process_cwd_drift"),
+            ("git_sha", "process_git_sha_drift"),
+        ):
+            baseline_value = getattr(baseline, field)
+            current_value = getattr(current, field)
+            if field == "cwd":
+                matches = _normalized_windows_path(
+                    baseline_value
+                ) == _normalized_windows_path(current_value)
+            else:
+                matches = baseline_value.casefold() == current_value.casefold()
+            if not matches:
+                raise EvidenceFailure(f"{code}:{role}")
+
+
 def parse_container_inspect(stdout: str) -> list[dict[str, object]]:
     try:
         payload = json.loads(stdout)
@@ -803,6 +1311,7 @@ def _scope() -> dict[str, object]:
 def base_evidence(config: CaptureConfig) -> dict[str, object]:
     return {
         "schema_version": SCHEMA_VERSION,
+        "topology_mode": LINUX_COMPOSE_MODE,
         "status": "running",
         "started_at_utc": utc_now(),
         "ended_at_utc": None,
@@ -866,22 +1375,285 @@ def capture_evidence(
     return evidence
 
 
+def _validate_windows_process_metrics(
+    metrics: dict[str, int | float],
+    *,
+    role: str,
+) -> None:
+    for field in ("rss_bytes", "peak_rss_bytes", "handles", "threads"):
+        value = metrics.get(field)
+        if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+            raise EvidenceFailure(f"process_metric_invalid:{role}:{field}")
+    for field, positive in (("cpu_time_seconds", True), ("cpu_percent", False)):
+        value = metrics.get(field)
+        if isinstance(value, bool) or not isinstance(value, (int, float)):
+            raise EvidenceFailure(f"process_metric_invalid:{role}:{field}")
+        numeric = float(value)
+        if not math.isfinite(numeric) or numeric < 0 or (positive and numeric == 0):
+            raise EvidenceFailure(f"process_metric_invalid:{role}:{field}")
+
+
+def _validate_windows_tcp_metrics(
+    metrics: dict[str, object],
+    *,
+    config: WindowsHostConfig,
+) -> None:
+    processes = metrics.get("processes")
+    host_tcp = metrics.get("host_tcp")
+    listener = metrics.get("api_listener")
+    if not isinstance(processes, dict) or set(processes) != {"api", "cloudflared"}:
+        raise EvidenceFailure("windows_tcp_processes_invalid")
+    for role in ("api", "cloudflared"):
+        values = processes.get(role)
+        if not isinstance(values, dict):
+            raise EvidenceFailure(f"windows_tcp_process_invalid:{role}")
+        for field in ("connections", "established", "listeners"):
+            value = values.get(field)
+            if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+                raise EvidenceFailure(f"windows_tcp_metric_invalid:{role}:{field}")
+    if not isinstance(host_tcp, dict):
+        raise EvidenceFailure("windows_host_tcp_invalid")
+    host_connections = host_tcp.get("connections")
+    if (
+        isinstance(host_connections, bool)
+        or not isinstance(host_connections, int)
+        or host_connections <= 0
+    ):
+        raise EvidenceFailure("windows_host_tcp_invalid")
+    if not isinstance(listener, dict):
+        raise EvidenceFailure("api_listener_invalid")
+    if listener.get("port") != config.api_listen_port:
+        raise EvidenceFailure("api_listener_port_mismatch")
+    owned = listener.get("owned_listener_count")
+    conflicts = listener.get("conflicting_listener_count")
+    if isinstance(owned, bool) or not isinstance(owned, int) or owned <= 0:
+        raise EvidenceFailure("api_listener_not_owned")
+    if isinstance(conflicts, bool) or not isinstance(conflicts, int) or conflicts != 0:
+        raise EvidenceFailure("api_listener_owner_conflict")
+    api = processes["api"]
+    cloudflared = processes["cloudflared"]
+    if api.get("listeners", 0) <= 0:
+        raise EvidenceFailure("api_process_listener_missing")
+    if cloudflared.get("established", 0) <= 0:
+        raise EvidenceFailure("cloudflared_tunnel_connection_missing")
+
+
+def collect_windows_sample(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+    targets: dict[str, WindowsProcessIdentity],
+    source_provenance: dict[str, object],
+    *,
+    sequence: int,
+) -> dict[str, object]:
+    validate_windows_source_provenance(config, runner, source, source_provenance)
+    validate_windows_pins(config, runner, source, targets)
+    process_metrics: dict[str, dict[str, int | float]] = {}
+    for role, target in targets.items():
+        metrics = source.read_metrics(pid=target.pid, role=role)
+        _validate_windows_process_metrics(metrics, role=role)
+        process_metrics[role] = metrics
+    tcp_metrics = source.read_tcp_metrics(
+        api_pid=targets["api"].pid,
+        cloudflared_pid=targets["cloudflared"].pid,
+        api_listen_port=config.api_listen_port,
+    )
+    _validate_windows_tcp_metrics(tcp_metrics, config=config)
+    validate_windows_pins(config, runner, source, targets)
+    validate_windows_source_provenance(config, runner, source, source_provenance)
+    return {
+        "sequence": sequence,
+        "observed_at_utc": utc_now(),
+        "processes": process_metrics,
+        "process_tcp": tcp_metrics["processes"],
+        "host_tcp": tcp_metrics["host_tcp"],
+        "api_listener": tcp_metrics["api_listener"],
+    }
+
+
+def _validate_windows_cpu_monotonic(
+    previous: dict[str, object],
+    current: dict[str, object],
+) -> None:
+    for role in ("api", "cloudflared"):
+        previous_value = previous["processes"][role]["cpu_time_seconds"]  # type: ignore[index]
+        current_value = current["processes"][role]["cpu_time_seconds"]  # type: ignore[index]
+        if current_value < previous_value:  # type: ignore[operator]
+            raise EvidenceFailure(f"process_cpu_time_regressed:{role}")
+
+
+def _windows_summary(samples: list[dict[str, object]]) -> dict[str, object]:
+    processes: dict[str, dict[str, int | float]] = {}
+    for role in ("api", "cloudflared"):
+        process_samples = [sample["processes"][role] for sample in samples]  # type: ignore[index]
+        tcp_samples = [sample["process_tcp"][role] for sample in samples]  # type: ignore[index]
+        processes[role] = {
+            f"{field}_max": max(item[field] for item in process_samples)  # type: ignore[index]
+            for field in (
+                "rss_bytes",
+                "peak_rss_bytes",
+                "cpu_time_seconds",
+                "cpu_percent",
+                "handles",
+                "threads",
+            )
+        }
+        processes[role].update(
+            {
+                f"tcp_{field}_max": max(item[field] for item in tcp_samples)  # type: ignore[index]
+                for field in ("connections", "established", "listeners")
+            }
+        )
+    listener_samples = [sample["api_listener"] for sample in samples]
+    host_samples = [sample["host_tcp"] for sample in samples]
+    return {
+        "processes": processes,
+        "api_listener": {
+            "port": listener_samples[0]["port"],  # type: ignore[index]
+            "owned_listener_count_min": min(
+                item["owned_listener_count"] for item in listener_samples  # type: ignore[index]
+            ),
+            "conflicting_listener_count_max": max(
+                item["conflicting_listener_count"] for item in listener_samples  # type: ignore[index]
+            ),
+        },
+        "host_tcp": {
+            "connections_max": max(item["connections"] for item in host_samples)  # type: ignore[index]
+        },
+    }
+
+
+def base_windows_evidence(config: WindowsHostConfig) -> dict[str, object]:
+    scope = _scope()
+    scope["topology_boundary"] = "windows_host_api_and_cloudflared_processes"
+    scope["configured_listener_port_retained"] = True
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "topology_mode": WINDOWS_HOST_MODE,
+        "status": "running",
+        "started_at_utc": utc_now(),
+        "ended_at_utc": None,
+        "scope": scope,
+        "requested": {
+            "public_host": config.public_host,
+            "repo_root": config.repo_root,
+            "git_sha": config.git_sha.lower(),
+            "source_pin": {
+                "git_tree_sha": config.git_tree_sha.lower(),
+                "script_sha256": {
+                    "runner": config.runner_script_sha256.lower(),
+                    "collector": config.collector_script_sha256.lower(),
+                    "checker": config.checker_script_sha256.lower(),
+                },
+                "runtime_dependencies": {"psutil": config.psutil_version},
+            },
+            "samples": config.samples,
+            "interval_seconds": config.interval_seconds,
+            "api_listen_port": config.api_listen_port,
+            "roles": {
+                "api": {
+                    "pid": config.api_pid,
+                    "expected_executable_name": config.api_executable_name,
+                    "expected_executable_sha256": (
+                        config.api_executable_sha256.lower()
+                    ),
+                    "expected_cwd": config.api_cwd,
+                },
+                "cloudflared": {
+                    "pid": config.cloudflared_pid,
+                    "expected_executable_name": config.cloudflared_executable_name,
+                    "expected_executable_sha256": (
+                        config.cloudflared_executable_sha256.lower()
+                    ),
+                    "expected_cwd": config.cloudflared_cwd,
+                },
+            },
+        },
+        "source_provenance": {},
+        "targets": {},
+        "samples_completed": 0,
+        "samples": [],
+        "summary": {},
+        "failure_type": None,
+    }
+
+
+def capture_windows_evidence(
+    config: WindowsHostConfig,
+    runner: CommandRunner,
+    source: WindowsSource,
+    *,
+    sleep=time.sleep,
+) -> dict[str, object]:
+    validate_windows_config(config)
+    if not runner.available("git"):
+        raise EvidenceFailure("command_unavailable:git")
+    source_provenance = read_windows_source_provenance(config, runner, source)
+    targets = pin_windows_targets(config, runner, source)
+    evidence = base_windows_evidence(config)
+    evidence["source_provenance"] = source_provenance
+    evidence["targets"] = {role: asdict(target) for role, target in targets.items()}
+    samples: list[dict[str, object]] = []
+    for index in range(config.samples):
+        if index:
+            sleep(config.interval_seconds)
+        sample = collect_windows_sample(
+            config,
+            runner,
+            source,
+            targets,
+            source_provenance,
+            sequence=index + 1,
+        )
+        if samples:
+            _validate_windows_cpu_monotonic(samples[-1], sample)
+        samples.append(sample)
+    evidence["samples"] = samples
+    evidence["samples_completed"] = len(samples)
+    evidence["summary"] = _windows_summary(samples)
+    evidence["status"] = "passed"
+    evidence["ended_at_utc"] = utc_now()
+    return evidence
+
+
 def parser() -> argparse.ArgumentParser:
     result = argparse.ArgumentParser(
-        description="Bounded metadata-only G7 Docker/cgroup/proc/socket sampler"
+        description="Bounded metadata-only G7 deployment topology sampler"
     )
-    result.add_argument("--compose-project", required=True)
+    result.add_argument(
+        "--topology-mode",
+        choices=("linux-compose", "windows-host"),
+        default="linux-compose",
+    )
+    result.add_argument("--compose-project")
     result.add_argument(
         "--public-host",
         required=True,
-        help="public WSS/API host bound to this exact Compose deployment",
+        help="public WSS/API host bound to this exact deployment",
     )
-    result.add_argument("--api-container", required=True)
+    result.add_argument("--api-container")
     result.add_argument("--api-service", default="api")
-    result.add_argument("--api-image-digest", required=True)
-    result.add_argument("--caddy-container", required=True)
+    result.add_argument("--api-image-digest")
+    result.add_argument("--caddy-container")
     result.add_argument("--caddy-service", default="caddy")
-    result.add_argument("--caddy-image-digest", required=True)
+    result.add_argument("--caddy-image-digest")
+    result.add_argument("--repo-root")
+    result.add_argument("--git-sha")
+    result.add_argument("--git-tree-sha")
+    result.add_argument("--runner-script-sha256")
+    result.add_argument("--collector-script-sha256")
+    result.add_argument("--checker-script-sha256")
+    result.add_argument("--psutil-version")
+    result.add_argument("--api-pid", type=int)
+    result.add_argument("--api-executable-name")
+    result.add_argument("--api-executable-sha256")
+    result.add_argument("--api-cwd")
+    result.add_argument("--api-listen-port", type=int)
+    result.add_argument("--cloudflared-pid", type=int)
+    result.add_argument("--cloudflared-executable-name")
+    result.add_argument("--cloudflared-executable-sha256")
+    result.add_argument("--cloudflared-cwd")
     result.add_argument("--samples", type=int, default=DEFAULT_SAMPLES)
     result.add_argument(
         "--interval-seconds", type=float, default=DEFAULT_INTERVAL_SECONDS
@@ -892,6 +1664,89 @@ def parser() -> argparse.ArgumentParser:
     return result
 
 
+def _required_cli_text(args: argparse.Namespace, name: str) -> str:
+    value = getattr(args, name)
+    if not isinstance(value, str) or not value.strip():
+        raise EvidenceFailure(f"required_argument_missing:{name.replace('_', '-')}")
+    return value.strip()
+
+
+def _required_cli_int(args: argparse.Namespace, name: str) -> int:
+    value = getattr(args, name)
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise EvidenceFailure(f"required_argument_missing:{name.replace('_', '-')}")
+    return value
+
+
+def _compose_config_from_args(args: argparse.Namespace) -> CaptureConfig:
+    return CaptureConfig(
+        compose_project=_required_cli_text(args, "compose_project"),
+        public_host=args.public_host,
+        api_container=_required_cli_text(args, "api_container"),
+        api_service=args.api_service,
+        api_image_digest=_required_cli_text(args, "api_image_digest"),
+        caddy_container=_required_cli_text(args, "caddy_container"),
+        caddy_service=args.caddy_service,
+        caddy_image_digest=_required_cli_text(args, "caddy_image_digest"),
+        samples=args.samples,
+        interval_seconds=args.interval_seconds,
+        proc_root=args.proc_root,
+        cgroup_root=args.cgroup_root,
+    )
+
+
+def _windows_config_from_args(args: argparse.Namespace) -> WindowsHostConfig:
+    return WindowsHostConfig(
+        public_host=args.public_host,
+        repo_root=_required_cli_text(args, "repo_root"),
+        git_sha=_required_cli_text(args, "git_sha"),
+        git_tree_sha=_required_cli_text(args, "git_tree_sha"),
+        runner_script_sha256=_required_cli_text(args, "runner_script_sha256"),
+        collector_script_sha256=_required_cli_text(
+            args, "collector_script_sha256"
+        ),
+        checker_script_sha256=_required_cli_text(args, "checker_script_sha256"),
+        psutil_version=_required_cli_text(args, "psutil_version"),
+        api_pid=_required_cli_int(args, "api_pid"),
+        api_executable_name=_required_cli_text(args, "api_executable_name"),
+        api_executable_sha256=_required_cli_text(args, "api_executable_sha256"),
+        api_cwd=_required_cli_text(args, "api_cwd"),
+        api_listen_port=_required_cli_int(args, "api_listen_port"),
+        cloudflared_pid=_required_cli_int(args, "cloudflared_pid"),
+        cloudflared_executable_name=_required_cli_text(
+            args, "cloudflared_executable_name"
+        ),
+        cloudflared_executable_sha256=_required_cli_text(
+            args, "cloudflared_executable_sha256"
+        ),
+        cloudflared_cwd=_required_cli_text(args, "cloudflared_cwd"),
+        samples=args.samples,
+        interval_seconds=args.interval_seconds,
+    )
+
+
+def _minimal_failure_evidence(
+    *,
+    topology_mode: str,
+    public_host: str,
+) -> dict[str, object]:
+    observed_at = utc_now()
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "topology_mode": topology_mode,
+        "status": "failed",
+        "started_at_utc": observed_at,
+        "ended_at_utc": observed_at,
+        "scope": _scope(),
+        "requested": {"public_host": public_host},
+        "targets": {},
+        "samples_completed": 0,
+        "samples": [],
+        "summary": {},
+        "failure_type": None,
+    }
+
+
 def _write_evidence(evidence: dict[str, object], output: Path | None) -> None:
     payload = json.dumps(evidence, ensure_ascii=False, indent=2, sort_keys=True) + "\n"
     if output is not None:
@@ -902,28 +1757,35 @@ def _write_evidence(evidence: dict[str, object], output: Path | None) -> None:
 
 def main() -> int:
     args = parser().parse_args()
-    config = CaptureConfig(
-        compose_project=args.compose_project,
-        public_host=args.public_host,
-        api_container=args.api_container,
-        api_service=args.api_service,
-        api_image_digest=args.api_image_digest,
-        caddy_container=args.caddy_container,
-        caddy_service=args.caddy_service,
-        caddy_image_digest=args.caddy_image_digest,
-        samples=args.samples,
-        interval_seconds=args.interval_seconds,
-        proc_root=args.proc_root,
-        cgroup_root=args.cgroup_root,
+    topology_mode = (
+        WINDOWS_HOST_MODE if args.topology_mode == "windows-host" else LINUX_COMPOSE_MODE
     )
+    config: CaptureConfig | WindowsHostConfig | None = None
     try:
-        evidence = capture_evidence(
-            config, SubprocessCommandRunner(), LocalFileSource()
-        )
+        if topology_mode == LINUX_COMPOSE_MODE:
+            config = _compose_config_from_args(args)
+            evidence = capture_evidence(
+                config, SubprocessCommandRunner(), LocalFileSource()
+            )
+        else:
+            config = _windows_config_from_args(args)
+            evidence = capture_windows_evidence(
+                config,
+                SubprocessCommandRunner(),
+                LocalWindowsSource(),
+            )
         _write_evidence(evidence, args.evidence_output)
         return 0
     except EvidenceFailure as exc:
-        evidence = base_evidence(config)
+        if isinstance(config, CaptureConfig):
+            evidence = base_evidence(config)
+        elif isinstance(config, WindowsHostConfig):
+            evidence = base_windows_evidence(config)
+        else:
+            evidence = _minimal_failure_evidence(
+                topology_mode=topology_mode,
+                public_host=args.public_host,
+            )
         evidence["status"] = "failed"
         evidence["failure_type"] = str(exc)
         evidence["ended_at_utc"] = utc_now()
diff --git a/scripts/check-dev-dashboard-ssot.py b/scripts/check-dev-dashboard-ssot.py
index 09dfa72..c49e0ee 100644
--- a/scripts/check-dev-dashboard-ssot.py
+++ b/scripts/check-dev-dashboard-ssot.py
@@ -23,8 +23,8 @@ DEFAULT_LOCAL_DEVELOPMENT = REPO_ROOT / "docs" / "guides" / "local-development.m
 DEFAULT_TODO = REPO_ROOT / "docs" / "TODO.md"
 
 EXPECTED_STATUS_COUNTS = {
-    "done": 33,
-    "doing": 2,
+    "done": 32,
+    "doing": 3,
     "planned": 0,
 }
 EXPECTED_OWNER_COLUMN_COUNTS = {
diff --git a/scripts/check-g7-external-proof.py b/scripts/check-g7-external-proof.py
index 76e77f9..2125a5f 100644
--- a/scripts/check-g7-external-proof.py
+++ b/scripts/check-g7-external-proof.py
@@ -2,9 +2,9 @@
 """Fail-closed validator for the complete G7 external evidence gate.
 
 All four artifacts are required: authenticated public physical-microphone soak,
-process-local voice runtime sampling, pinned Linux topology sampling, and an
-independent human-held-out voice-gain pack. No artifact may contain raw audio or
-transcripts, and synthetic evidence cannot satisfy this gate.
+process-local voice runtime sampling, pinned deployment topology sampling, and
+an independent human-held-out voice-gain pack. No artifact may contain raw audio
+or transcripts, and synthetic evidence cannot satisfy this gate.
 """
 
 from __future__ import annotations
@@ -13,6 +13,7 @@ import argparse
 import hashlib
 import json
 import math
+import ntpath
 import sys
 from datetime import UTC, datetime
 from pathlib import Path
@@ -29,6 +30,7 @@ from app.services.g7_voice_gain_evidence import evaluate_human_voice_gain  # noq
 
 
 MINIMUM_SOAK_SECONDS = 3_000.0
+PINNED_PSUTIL_VERSION = "6.1.1"
 
 # 이 게이트는 특정 벤더가 아니라 **운영하기로 결정한 provider** 를 강제한다.
 # 2026-08-08 소유자 결정: STT 는 노트북 상주 faster-whisper(`local_whisper`),
@@ -82,6 +84,15 @@ def _iso(value: object) -> datetime | None:
     return parsed.astimezone(UTC)
 
 
+def _lower_hex(value: object, lengths: set[int]) -> bool:
+    return (
+        isinstance(value, str)
+        and len(value) in lengths
+        and value == value.lower()
+        and all(character in "0123456789abcdef" for character in value)
+    )
+
+
 def validate_public_soak(payload: dict[str, Any], errors: list[str]) -> None:
     prefix = "voice_soak"
     _require(
@@ -327,57 +338,11 @@ def validate_runtime(payload: dict[str, Any], errors: list[str]) -> None:
                 _require(errors, counters.get(field) == 0, f"{prefix}:{field}")
 
 
-def validate_topology(payload: dict[str, Any], errors: list[str]) -> None:
+def _validate_linux_compose_topology(
+    payload: dict[str, Any],
+    errors: list[str],
+) -> None:
     prefix = "topology"
-    _require(
-        errors,
-        payload.get("schema_version") == "vignette.g7-topology-evidence.v1",
-        f"{prefix}:schema",
-    )
-    _require(errors, payload.get("status") == "passed", f"{prefix}:status")
-    scope = payload.get("scope")
-    _require(
-        errors,
-        isinstance(scope, dict) and scope.get("metadata_only") is True,
-        f"{prefix}:privacy",
-    )
-    if isinstance(scope, dict):
-        for field in (
-            "raw_command_output_retained",
-            "socket_endpoints_retained",
-            "request_payloads_retained",
-            "audio_retained",
-            "transcripts_retained",
-        ):
-            _require(errors, scope.get(field) is False, f"{prefix}:{field}")
-        edge = scope.get("cloudflare_edge")
-        _require(
-            errors,
-            isinstance(edge, dict)
-            and edge.get("internal_queue_measured") is False
-            and edge.get("evidence_boundary") == "separate_external_artifact_required",
-            f"{prefix}:edge_boundary",
-        )
-    requested = payload.get("requested")
-    completed = payload.get("samples_completed")
-    _require(errors, isinstance(requested, dict), f"{prefix}:requested")
-    if isinstance(requested, dict):
-        sample_count = requested.get("samples")
-        interval = _number(requested.get("interval_seconds"))
-        _require(
-            errors,
-            isinstance(sample_count, int)
-            and sample_count == completed
-            and sample_count > 1,
-            f"{prefix}:sample_count",
-        )
-        _require(
-            errors,
-            interval is not None
-            and isinstance(completed, int)
-            and (completed - 1) * interval >= MINIMUM_SOAK_SECONDS,
-            f"{prefix}:coverage",
-        )
     targets = payload.get("targets")
     _require(
         errors,
@@ -442,6 +407,499 @@ def validate_topology(payload: dict[str, Any], errors: list[str]) -> None:
             and (_number(host_tcp.get("connections_max")) or 0) > 0,
             f"{prefix}:host_tcp",
         )
+
+
+def _validate_windows_topology(
+    payload: dict[str, Any],
+    errors: list[str],
+) -> None:
+    prefix = "topology"
+    requested = payload.get("requested")
+    _require(errors, isinstance(requested, dict), f"{prefix}:windows_requested")
+    if not isinstance(requested, dict):
+        return
+    expected_git_sha = requested.get("git_sha")
+    _require(
+        errors,
+        _lower_hex(expected_git_sha, {40, 64}),
+        f"{prefix}:windows_git_sha",
+    )
+    source_pin = requested.get("source_pin")
+    _require(
+        errors,
+        isinstance(source_pin, dict),
+        f"{prefix}:windows_source_pin",
+    )
+    expected_tree_sha = (
+        source_pin.get("git_tree_sha") if isinstance(source_pin, dict) else None
+    )
+    expected_scripts = (
+        source_pin.get("script_sha256") if isinstance(source_pin, dict) else None
+    )
+    expected_dependencies = (
+        source_pin.get("runtime_dependencies") if isinstance(source_pin, dict) else None
+    )
+    _require(
+        errors,
+        _lower_hex(expected_tree_sha, {40, 64}),
+        f"{prefix}:windows_git_tree_sha_pin",
+    )
+    _require(
+        errors,
+        isinstance(expected_scripts, dict)
+        and set(expected_scripts) == {"runner", "collector", "checker"}
+        and all(_lower_hex(value, {64}) for value in expected_scripts.values()),
+        f"{prefix}:windows_script_sha256_pin",
+    )
+    _require(
+        errors,
+        isinstance(expected_dependencies, dict)
+        and expected_dependencies == {"psutil": PINNED_PSUTIL_VERSION},
+        f"{prefix}:windows_psutil_version_pin",
+    )
+
+    source_provenance = payload.get("source_provenance")
+    _require(
+        errors,
+        isinstance(source_provenance, dict),
+        f"{prefix}:windows_source_provenance",
+    )
+    if isinstance(source_provenance, dict):
+        observed_scripts = source_provenance.get("script_sha256")
+        observed_dependencies = source_provenance.get("runtime_dependencies")
+        _require(
+            errors,
+            source_provenance.get("detached_head") is True,
+            f"{prefix}:windows_detached_head",
+        )
+        _require(
+            errors,
+            source_provenance.get("tracked_clean") is True,
+            f"{prefix}:windows_tracked_clean",
+        )
+        _require(
+            errors,
+            source_provenance.get("git_sha") == expected_git_sha,
+            f"{prefix}:windows_source_git_sha",
+        )
+        _require(
+            errors,
+            source_provenance.get("git_tree_sha") == expected_tree_sha,
+            f"{prefix}:windows_source_git_tree_sha",
+        )
+        _require(
+            errors,
+            isinstance(observed_scripts, dict)
+            and isinstance(expected_scripts, dict)
+            and observed_scripts == expected_scripts,
+            f"{prefix}:windows_source_script_sha256",
+        )
+        _require(
+            errors,
+            isinstance(observed_dependencies, dict)
+            and isinstance(expected_dependencies, dict)
+            and observed_dependencies == expected_dependencies,
+            f"{prefix}:windows_source_psutil_version",
+        )
+    repo_root = requested.get("repo_root")
+    _require(
+        errors,
+        isinstance(repo_root, str) and ntpath.isabs(repo_root),
+        f"{prefix}:windows_repo_root",
+    )
+    api_listen_port = requested.get("api_listen_port")
+    _require(
+        errors,
+        isinstance(api_listen_port, int)
+        and not isinstance(api_listen_port, bool)
+        and 1 <= api_listen_port <= 65_535,
+        f"{prefix}:windows_api_listen_port",
+    )
+    requested_roles = requested.get("roles")
+    _require(
+        errors,
+        isinstance(requested_roles, dict)
+        and set(requested_roles) == {"api", "cloudflared"},
+        f"{prefix}:windows_requested_roles",
+    )
+    targets = payload.get("targets")
+    _require(
+        errors,
+        isinstance(targets, dict) and set(targets) == {"api", "cloudflared"},
+        f"{prefix}:targets",
+    )
+    capture_started = _iso(payload.get("started_at_utc"))
+    target_pids: list[int] = []
+    if isinstance(targets, dict) and isinstance(requested_roles, dict):
+        for role in ("api", "cloudflared"):
+            target = targets.get(role)
+            expectation = requested_roles.get(role)
+            _require(errors, isinstance(target, dict), f"{prefix}:{role}_target")
+            _require(
+                errors,
+                isinstance(expectation, dict),
+                f"{prefix}:{role}_expectation",
+            )
+            if not isinstance(target, dict) or not isinstance(expectation, dict):
+                continue
+            _require(
+                errors,
+                target.get("role") == role,
+                f"{prefix}:{role}_role",
+            )
+            pid = target.get("pid")
+            _require(
+                errors,
+                isinstance(pid, int) and not isinstance(pid, bool) and pid > 0,
+                f"{prefix}:{role}_pid",
+            )
+            if isinstance(pid, int) and not isinstance(pid, bool):
+                target_pids.append(pid)
+            _require(
+                errors,
+                pid == expectation.get("pid"),
+                f"{prefix}:{role}_pid_pin",
+            )
+            executable_sha256 = target.get("executable_sha256")
+            _require(
+                errors,
+                _lower_hex(executable_sha256, {64})
+                and executable_sha256 == expectation.get("expected_executable_sha256"),
+                f"{prefix}:{role}_executable_sha256",
+            )
+            _require(
+                errors,
+                _lower_hex(target.get("command_line_sha256"), {64}),
+                f"{prefix}:{role}_command_line_sha256",
+            )
+            executable_name = target.get("executable_name")
+            expected_name = expectation.get("expected_executable_name")
+            _require(
+                errors,
+                isinstance(executable_name, str)
+                and isinstance(expected_name, str)
+                and executable_name.casefold() == expected_name.casefold(),
+                f"{prefix}:{role}_executable_name",
+            )
+            cwd = target.get("cwd")
+            expected_cwd = expectation.get("expected_cwd")
+            _require(
+                errors,
+                isinstance(cwd, str)
+                and isinstance(expected_cwd, str)
+                and ntpath.normcase(ntpath.normpath(cwd))
+                == ntpath.normcase(ntpath.normpath(expected_cwd)),
+                f"{prefix}:{role}_cwd",
+            )
+            _require(
+                errors,
+                target.get("git_sha") == expected_git_sha,
+                f"{prefix}:{role}_git_sha",
+            )
+            target_started = _iso(target.get("started_at"))
+            _require(
+                errors,
+                capture_started is not None
+                and target_started is not None
+                and target_started <= capture_started,
+                f"{prefix}:{role}_process_start",
+            )
+    _require(
+        errors,
+        len(target_pids) == 2 and len(set(target_pids)) == 2,
+        f"{prefix}:windows_distinct_pids",
+    )
+
+    completed = payload.get("samples_completed")
+    samples = payload.get("samples")
+    _require(
+        errors,
+        isinstance(samples, list)
+        and isinstance(completed, int)
+        and len(samples) == completed,
+        f"{prefix}:windows_samples",
+    )
+    capture_ended = _iso(payload.get("ended_at_utc"))
+    metric_values: dict[str, dict[str, list[float]]] = {
+        role: {
+            field: []
+            for field in (
+                "rss_bytes",
+                "peak_rss_bytes",
+                "cpu_time_seconds",
+                "cpu_percent",
+                "handles",
+                "threads",
+            )
+        }
+        for role in ("api", "cloudflared")
+    }
+    tcp_values: dict[str, dict[str, list[int]]] = {
+        role: {field: [] for field in ("connections", "established", "listeners")}
+        for role in ("api", "cloudflared")
+    }
+    listener_owned: list[int] = []
+    listener_conflicts: list[int] = []
+    host_connections: list[int] = []
+    if isinstance(samples, list):
+        previous_cpu: dict[str, float] = {}
+        for index, sample in enumerate(samples, start=1):
+            if not isinstance(sample, dict):
+                errors.append(f"{prefix}:windows_sample_shape")
+                continue
+            _require(
+                errors,
+                sample.get("sequence") == index,
+                f"{prefix}:windows_sample_sequence",
+            )
+            observed_at = _iso(sample.get("observed_at_utc"))
+            _require(
+                errors,
+                capture_started is not None
+                and capture_ended is not None
+                and observed_at is not None
+                and capture_started <= observed_at <= capture_ended,
+                f"{prefix}:windows_sample_time",
+            )
+            processes = sample.get("processes")
+            process_tcp = sample.get("process_tcp")
+            _require(
+                errors,
+                isinstance(processes, dict)
+                and set(processes) == {"api", "cloudflared"},
+                f"{prefix}:windows_sample_processes",
+            )
+            _require(
+                errors,
+                isinstance(process_tcp, dict)
+                and set(process_tcp) == {"api", "cloudflared"},
+                f"{prefix}:windows_sample_process_tcp",
+            )
+            for role in ("api", "cloudflared"):
+                metrics = processes.get(role) if isinstance(processes, dict) else None
+                tcp = process_tcp.get(role) if isinstance(process_tcp, dict) else None
+                _require(
+                    errors,
+                    isinstance(metrics, dict),
+                    f"{prefix}:{role}_sample_metrics",
+                )
+                _require(
+                    errors,
+                    isinstance(tcp, dict),
+                    f"{prefix}:{role}_sample_tcp",
+                )
+                if isinstance(metrics, dict):
+                    for field in metric_values[role]:
+                        numeric = _number(metrics.get(field))
+                        positive = field != "cpu_percent"
+                        _require(
+                            errors,
+                            numeric is not None
+                            and numeric >= 0
+                            and (not positive or numeric > 0),
+                            f"{prefix}:{role}_{field}_sample",
+                        )
+                        if numeric is not None:
+                            metric_values[role][field].append(numeric)
+                    cpu_time = _number(metrics.get("cpu_time_seconds"))
+                    if cpu_time is not None:
+                        _require(
+                            errors,
+                            cpu_time >= previous_cpu.get(role, 0.0),
+                            f"{prefix}:{role}_cpu_time_monotonic",
+                        )
+                        previous_cpu[role] = cpu_time
+                if isinstance(tcp, dict):
+                    for field in tcp_values[role]:
+                        value = tcp.get(field)
+                        _require(
+                            errors,
+                            isinstance(value, int)
+                            and not isinstance(value, bool)
+                            and value >= 0,
+                            f"{prefix}:{role}_tcp_{field}_sample",
+                        )
+                        if isinstance(value, int) and not isinstance(value, bool):
+                            tcp_values[role][field].append(value)
+                    if role == "api":
+                        _require(
+                            errors,
+                            (_number(tcp.get("listeners")) or 0) > 0,
+                            f"{prefix}:api_listener_sample",
+                        )
+                    else:
+                        _require(
+                            errors,
+                            (_number(tcp.get("established")) or 0) > 0,
+                            f"{prefix}:cloudflared_tunnel_sample",
+                        )
+            listener = sample.get("api_listener")
+            host_tcp = sample.get("host_tcp")
+            _require(errors, isinstance(listener, dict), f"{prefix}:listener_sample")
+            _require(errors, isinstance(host_tcp, dict), f"{prefix}:host_tcp_sample")
+            if isinstance(listener, dict):
+                owned = listener.get("owned_listener_count")
+                conflicts = listener.get("conflicting_listener_count")
+                _require(
+                    errors,
+                    listener.get("port") == api_listen_port,
+                    f"{prefix}:listener_port_sample",
+                )
+                _require(
+                    errors,
+                    isinstance(owned, int) and not isinstance(owned, bool) and owned > 0,
+                    f"{prefix}:listener_owner_sample",
+                )
+                _require(
+                    errors,
+                    isinstance(conflicts, int)
+                    and not isinstance(conflicts, bool)
+                    and conflicts == 0,
+                    f"{prefix}:listener_conflict_sample",
+                )
+                if isinstance(owned, int) and not isinstance(owned, bool):
+                    listener_owned.append(owned)
+                if isinstance(conflicts, int) and not isinstance(conflicts, bool):
+                    listener_conflicts.append(conflicts)
+            if isinstance(host_tcp, dict):
+                connections = host_tcp.get("connections")
+                _require(
+                    errors,
+                    isinstance(connections, int)
+                    and not isinstance(connections, bool)
+                    and connections > 0,
+                    f"{prefix}:host_tcp_connections_sample",
+                )
+                if isinstance(connections, int) and not isinstance(connections, bool):
+                    host_connections.append(connections)
+
+    summary = payload.get("summary")
+    _require(errors, isinstance(summary, dict), f"{prefix}:summary")
+    if isinstance(summary, dict):
+        process_summary = summary.get("processes")
+        listener_summary = summary.get("api_listener")
+        host_summary = summary.get("host_tcp")
+        _require(
+            errors,
+            isinstance(process_summary, dict)
+            and set(process_summary) == {"api", "cloudflared"},
+            f"{prefix}:windows_process_summary",
+        )
+        if isinstance(process_summary, dict):
+            for role in ("api", "cloudflared"):
+                values = process_summary.get(role)
+                _require(
+                    errors,
+                    isinstance(values, dict),
+                    f"{prefix}:{role}_summary",
+                )
+                if not isinstance(values, dict):
+                    continue
+                for field, observations in metric_values[role].items():
+                    _require(
+                        errors,
+                        bool(observations)
+                        and _number(values.get(f"{field}_max")) == max(observations),
+                        f"{prefix}:{role}_{field}_max",
+                    )
+                for field, observations in tcp_values[role].items():
+                    _require(
+                        errors,
+                        bool(observations)
+                        and _number(values.get(f"tcp_{field}_max"))
+                        == max(observations),
+                        f"{prefix}:{role}_tcp_{field}_max",
+                    )
+        _require(
+            errors,
+            isinstance(listener_summary, dict)
+            and listener_summary.get("port") == api_listen_port
+            and bool(listener_owned)
+            and listener_summary.get("owned_listener_count_min")
+            == min(listener_owned)
+            and bool(listener_conflicts)
+            and listener_summary.get("conflicting_listener_count_max")
+            == max(listener_conflicts),
+            f"{prefix}:windows_listener_summary",
+        )
+        _require(
+            errors,
+            isinstance(host_summary, dict)
+            and bool(host_connections)
+            and host_summary.get("connections_max") == max(host_connections),
+            f"{prefix}:host_tcp",
+        )
+
+
+def validate_topology(payload: dict[str, Any], errors: list[str]) -> None:
+    prefix = "topology"
+    _require(
+        errors,
+        payload.get("schema_version") == "vignette.g7-topology-evidence.v1",
+        f"{prefix}:schema",
+    )
+    _require(errors, payload.get("status") == "passed", f"{prefix}:status")
+    scope = payload.get("scope")
+    _require(
+        errors,
+        isinstance(scope, dict) and scope.get("metadata_only") is True,
+        f"{prefix}:privacy",
+    )
+    if isinstance(scope, dict):
+        for field in (
+            "raw_command_output_retained",
+            "socket_endpoints_retained",
+            "request_payloads_retained",
+            "audio_retained",
+            "transcripts_retained",
+        ):
+            _require(errors, scope.get(field) is False, f"{prefix}:{field}")
+        edge = scope.get("cloudflare_edge")
+        _require(
+            errors,
+            isinstance(edge, dict)
+            and edge.get("internal_queue_measured") is False
+            and edge.get("evidence_boundary") == "separate_external_artifact_required",
+            f"{prefix}:edge_boundary",
+        )
+    requested = payload.get("requested")
+    completed = payload.get("samples_completed")
+    _require(errors, isinstance(requested, dict), f"{prefix}:requested")
+    if isinstance(requested, dict):
+        sample_count = requested.get("samples")
+        interval = _number(requested.get("interval_seconds"))
+        _require(
+            errors,
+            isinstance(sample_count, int)
+            and sample_count == completed
+            and sample_count > 1,
+            f"{prefix}:sample_count",
+        )
+        _require(
+            errors,
+            interval is not None
+            and isinstance(completed, int)
+            and (completed - 1) * interval >= MINIMUM_SOAK_SECONDS,
+            f"{prefix}:coverage",
+        )
+    topology_mode = payload.get("topology_mode")
+    _require(
+        errors,
+        topology_mode in (None, "linux_compose", "windows_host"),
+        f"{prefix}:mode",
+    )
+    if topology_mode == "windows_host":
+        _require(
+            errors,
+            isinstance(scope, dict)
+            and scope.get("topology_boundary")
+            == "windows_host_api_and_cloudflared_processes"
+            and scope.get("configured_listener_port_retained") is True,
+            f"{prefix}:windows_scope",
+        )
+        _validate_windows_topology(payload, errors)
+    elif topology_mode in (None, "linux_compose"):
+        _validate_linux_compose_topology(payload, errors)
     _require(errors, payload.get("failure_type") is None, f"{prefix}:failure")
 
 
@@ -489,11 +947,20 @@ def validate_binding(
         else:
             windows.append((start, end))
     if len(windows) == 3:
+        overlap_started = max(start for start, _ in windows)
+        overlap_ended = min(end for _, end in windows)
         _require(
             errors,
-            max(start for start, _ in windows) <= min(end for _, end in windows),
+            overlap_started <= overlap_ended,
             "binding:no_concurrent_overlap",
         )
+        if overlap_started <= overlap_ended:
+            _require(
+                errors,
+                (overlap_ended - overlap_started).total_seconds()
+                >= MINIMUM_SOAK_SECONDS,
+                "binding:concurrent_overlap_below_3000_seconds",
+            )
 
 
 def artifact_sha256(path: Path) -> str:
diff --git a/scripts/install-public-runtime-task.ps1 b/scripts/install-public-runtime-task.ps1
index 97338d1..5411d2a 100644
--- a/scripts/install-public-runtime-task.ps1
+++ b/scripts/install-public-runtime-task.ps1
@@ -1,5 +1,6 @@
 param(
-  [string]$Workspace = "D:\workspace\vignette",
+  [Parameter(Mandatory = $true)]
+  [string]$StableSourceRoot,
   [string]$TaskName = "VignettePublicRuntimeWatchdog",
   [int]$IntervalMinutes = 5,
   [string[]]$AdditionalPublicHealthUrls = @(),
@@ -14,11 +15,72 @@ if ($IntervalMinutes -lt 1) {
   throw "IntervalMinutes must be 1 or greater"
 }
 
-$watchScript = Join-Path $Workspace "scripts\watch-public-runtime.ps1"
-if (!(Test-Path $watchScript)) {
-  throw "Watchdog script not found at $watchScript"
+$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
+$installerScript = Join-Path $resolvedSourceRoot "scripts\install-public-runtime-task.ps1"
+$watchScript = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime.ps1"
+$startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
+
+function Invoke-GitText {
+  param([string[]]$Arguments)
+
+  $value = & git.exe -C $resolvedSourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
 }
 
+foreach ($requiredScript in @($installerScript, $watchScript, $startScript)) {
+  if (!(Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
+    throw "Public runtime script not found at $requiredScript"
+  }
+}
+
+$runningInstaller = (Resolve-Path -LiteralPath $PSCommandPath).Path
+if (-not [string]::Equals(
+    $runningInstaller,
+    (Resolve-Path -LiteralPath $installerScript).Path,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Watchdog installer is not executing from the pinned stable source root"
+}
+
+$gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
+$resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+if (-not [string]::Equals(
+    $resolvedGitRoot,
+    $resolvedSourceRoot,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Stable source root does not match its Git toplevel"
+}
+
+$symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+$symbolicHeadExit = $LASTEXITCODE
+if ($symbolicHeadExit -eq 0) {
+  throw "Stable source must be a detached HEAD, not branch $symbolicHead"
+}
+if ($symbolicHeadExit -ne 1) {
+  throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+}
+
+$dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+if ($dirty) {
+  throw "Stable source is not clean; refusing watchdog installation"
+}
+foreach ($relativePath in @(
+  "scripts/install-public-runtime-task.ps1",
+  "scripts/watch-public-runtime.ps1",
+  "scripts/start-public-runtime.ps1"
+)) {
+  Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
+}
+
+$sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
+$sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+$watchdogSha256 = (Get-FileHash -LiteralPath $watchScript -Algorithm SHA256).Hash.ToLowerInvariant()
+$startScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+
 $powershell = (Get-Command powershell.exe).Source
 $userId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
 
@@ -26,7 +88,11 @@ $actionArguments = @(
   "-NoProfile",
   "-ExecutionPolicy Bypass",
   "-File `"$watchScript`"",
-  "-Workspace `"$Workspace`""
+  "-StableSourceRoot `"$resolvedSourceRoot`"",
+  "-ExpectedSourceCommit $sourceCommit",
+  "-ExpectedSourceTree $sourceTree",
+  "-ExpectedWatchdogSha256 $watchdogSha256",
+  "-ExpectedStartScriptSha256 $startScriptSha256"
 )
 if ($SkipPublicHealth) {
   $actionArguments += "-SkipPublicHealth"
@@ -42,7 +108,7 @@ if ($AdditionalPublicHealthUrls.Count -gt 0) {
 $action = New-ScheduledTaskAction `
   -Execute $powershell `
   -Argument ($actionArguments -join " ") `
-  -WorkingDirectory $Workspace
+  -WorkingDirectory $resolvedSourceRoot
 
 $logonTrigger = New-ScheduledTaskTrigger -AtLogOn -User $userId
 $repeatTrigger = New-ScheduledTaskTrigger `
@@ -65,7 +131,7 @@ $principal = New-ScheduledTaskPrincipal `
   -LogonType Interactive `
   -RunLevel Limited
 
-$description = "Runs Vignette public runtime watchdog as $userId. Secrets stay in the user profile and apps/api/.env; the task command stores no secrets."
+$description = "Runs Vignette public runtime watchdog as $userId from detached clean commit $sourceCommit. Secrets stay in the user profile and apps/api/.env; the task command stores no secrets."
 $task = New-ScheduledTask `
   -Action $action `
   -Trigger @($logonTrigger, $repeatTrigger) `
@@ -77,6 +143,8 @@ Register-ScheduledTask -TaskName $TaskName -InputObject $task -Force | Out-Null
 
 Write-Output "Installed scheduled task '$TaskName' for $userId"
 Write-Output "Action: $powershell $($actionArguments -join ' ')"
+Write-Output "Pinned source: root=$resolvedSourceRoot commit=$sourceCommit tree=$sourceTree"
+Write-Output "Pinned scripts: watchdog_sha256=$watchdogSha256 start_sha256=$startScriptSha256"
 Write-Output "Interval: every $IntervalMinutes minute(s), plus at user logon"
 if ($AdditionalPublicHealthUrls.Count -gt 0) {
   Write-Output "Additional public health URLs: $($AdditionalPublicHealthUrls -join ', ')"
diff --git a/scripts/local-whisper-stt-server.py b/scripts/local-whisper-stt-server.py
index b76254d..fb9f3f6 100644
--- a/scripts/local-whisper-stt-server.py
+++ b/scripts/local-whisper-stt-server.py
@@ -36,7 +36,7 @@ from urllib.parse import parse_qs, urlsplit
 
 DEFAULT_HOST = "127.0.0.1"
 DEFAULT_PORT = 9882
-DEFAULT_MODEL = "large-v3"
+DEFAULT_MODEL = "small"
 DEFAULT_LANGUAGE = "ko"
 DEFAULT_SAMPLE_RATE = 16_000
 DEFAULT_CHANNELS = 1
@@ -546,6 +546,7 @@ async def serve(args: argparse.Namespace) -> int:  # pragma: no cover - I/O 진
         await send(
             {
                 "type": "ready",
+                "provider": "local_whisper",
                 "model": transcriber.model_name,
                 "device": transcriber.device,
                 "compute_type": transcriber.compute_type,
@@ -579,6 +580,7 @@ async def serve(args: argparse.Namespace) -> int:  # pragma: no cover - I/O 진
         json.dumps(
             {
                 "ready": True,
+                "provider": "local_whisper",
                 "host": args.host,
                 "port": args.port,
                 "model": transcriber.model_name,
diff --git a/scripts/melotts-server.py b/scripts/melotts-server.py
index 59a8238..d2f7d52 100644
--- a/scripts/melotts-server.py
+++ b/scripts/melotts-server.py
@@ -114,6 +114,7 @@ def encode_wav(samples: Iterable[float], sample_rate: int) -> bytes:
 def health_payload(synthesizer: Synthesizer, *, speakers: Iterable[str]) -> dict[str, Any]:
     return {
         "status": "ok",
+        "provider": "melotts",
         "model": MODEL_ID,
         "language": DEFAULT_LANGUAGE,
         "license": LICENSE_ID,
diff --git a/scripts/probe-public-voice-sidecars.py b/scripts/probe-public-voice-sidecars.py
new file mode 100644
index 0000000..ab99e17
--- /dev/null
+++ b/scripts/probe-public-voice-sidecars.py
@@ -0,0 +1,282 @@
+#!/usr/bin/env python3
+"""Fail-closed, metadata-only readiness probe for the public voice sidecars.
+
+The probe never sends audio or synthesis text.  It proves the local Whisper
+WebSocket protocol by validating its first ``ready`` frame, and proves MeloTTS
+through its loopback ``/health`` document.  Only bounded, non-PII metadata is
+printed.
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import sys
+from collections.abc import Iterable, Mapping
+from typing import Any
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+from urllib.request import ProxyHandler, Request, build_opener
+
+
+DEFAULT_STT_URL = "ws://127.0.0.1:9882/v1/listen"
+DEFAULT_TTS_URL = "http://127.0.0.1:9883"
+DEFAULT_STT_PROVIDER = "local_whisper"
+DEFAULT_STT_MODEL = "small"
+DEFAULT_STT_LANGUAGE = "ko"
+DEFAULT_STT_DEVICE = "cpu"
+DEFAULT_TTS_PROVIDER = "melotts"
+DEFAULT_TTS_MODEL = "melotts-korean"
+DEFAULT_TTS_LANGUAGE = "KR"
+MAX_METADATA_BYTES = 64 * 1024
+LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+
+class ProbeError(RuntimeError):
+    """A stable, non-sensitive readiness failure code."""
+
+
+def _loopback_parts(url: str, *, schemes: set[str]) -> Any:
+    parts = urlsplit(url)
+    if (
+        parts.scheme not in schemes
+        or parts.hostname not in LOOPBACK_HOSTS
+        or parts.username is not None
+        or parts.password is not None
+        or parts.fragment
+    ):
+        raise ProbeError("loopback_url_required")
+    return parts
+
+
+def build_stt_probe_url(
+    base_url: str,
+    *,
+    model: str,
+    language: str,
+) -> str:
+    parts = _loopback_parts(base_url, schemes={"ws"})
+    query = dict(parse_qsl(parts.query, keep_blank_values=True))
+    query.update(
+        {
+            "model": model,
+            "language": language,
+            "sample_rate": "16000",
+            "channels": "1",
+        }
+    )
+    return urlunsplit(
+        (parts.scheme, parts.netloc, parts.path, urlencode(query), "")
+    )
+
+
+def validate_stt_ready(
+    payload: object,
+    *,
+    provider: str,
+    model: str,
+    language: str,
+    device: str,
+) -> dict[str, object]:
+    if not isinstance(payload, Mapping):
+        raise ProbeError("stt_ready_not_object")
+    expected = {
+        "type": "ready",
+        "provider": provider,
+        "model": model,
+        "language": language,
+        "device": device,
+        "sample_rate": 16_000,
+    }
+    for key, value in expected.items():
+        if payload.get(key) != value:
+            raise ProbeError(f"stt_{key}_mismatch")
+    expected_compute_type = "int8" if device == "cpu" else "float16"
+    if payload.get("compute_type") != expected_compute_type:
+        raise ProbeError("stt_compute_type_mismatch")
+    return {
+        "provider": provider,
+        "model": model,
+        "language": language,
+        "device": device,
+        "compute_type": expected_compute_type,
+        "sample_rate": 16_000,
+    }
+
+
+def validate_tts_health(
+    payload: object,
+    *,
+    provider: str,
+    model: str,
+    language: str,
+) -> dict[str, object]:
+    if not isinstance(payload, Mapping):
+        raise ProbeError("tts_health_not_object")
+    expected = {
+        "status": "ok",
+        "provider": provider,
+        "model": model,
+        "language": language,
+        "license": "MIT",
+        "reference_policy": "pretrained-multispeaker-no-external-reference",
+    }
+    for key, value in expected.items():
+        if payload.get(key) != value:
+            raise ProbeError(f"tts_{key}_mismatch")
+    sample_rate = payload.get("sample_rate")
+    speakers = payload.get("speakers")
+    if not isinstance(sample_rate, int) or sample_rate <= 0:
+        raise ProbeError("tts_sample_rate_invalid")
+    if not isinstance(speakers, list) or not speakers:
+        raise ProbeError("tts_speakers_missing")
+    return {
+        "provider": provider,
+        "model": model,
+        "language": language,
+        "license": "MIT",
+        "sample_rate": sample_rate,
+    }
+
+
+async def probe_stt(
+    url: str,
+    *,
+    provider: str,
+    model: str,
+    language: str,
+    device: str,
+    timeout_seconds: float,
+) -> dict[str, object]:
+    from websockets.asyncio.client import connect
+
+    probe_url = build_stt_probe_url(url, model=model, language=language)
+    try:
+        async with asyncio.timeout(timeout_seconds):
+            async with connect(
+                probe_url,
+                max_size=MAX_METADATA_BYTES,
+                max_queue=1,
+                ping_interval=None,
+            ) as socket:
+                frame = await socket.recv()
+    except ProbeError:
+        raise
+    except Exception as exc:
+        raise ProbeError("stt_connection_failed") from exc
+    if not isinstance(frame, str) or len(frame.encode("utf-8")) > MAX_METADATA_BYTES:
+        raise ProbeError("stt_ready_frame_invalid")
+    try:
+        payload = json.loads(frame)
+    except ValueError as exc:
+        raise ProbeError("stt_ready_json_invalid") from exc
+    return validate_stt_ready(
+        payload,
+        provider=provider,
+        model=model,
+        language=language,
+        device=device,
+    )
+
+
+def probe_tts(
+    url: str,
+    *,
+    provider: str,
+    model: str,
+    language: str,
+    timeout_seconds: float,
+) -> dict[str, object]:
+    parts = _loopback_parts(url, schemes={"http"})
+    health_path = parts.path.rstrip("/") + "/health"
+    health_url = urlunsplit((parts.scheme, parts.netloc, health_path, "", ""))
+    request = Request(
+        health_url,
+        method="GET",
+        headers={"Accept": "application/json", "User-Agent": "vignette-readiness/1"},
+    )
+    try:
+        with build_opener(ProxyHandler({})).open(
+            request, timeout=timeout_seconds
+        ) as response:
+            content_type = response.headers.get_content_type()
+            body = response.read(MAX_METADATA_BYTES + 1)
+            status = response.status
+    except Exception as exc:
+        raise ProbeError("tts_connection_failed") from exc
+    if status != 200:
+        raise ProbeError("tts_health_status_invalid")
+    if content_type != "application/json" or len(body) > MAX_METADATA_BYTES:
+        raise ProbeError("tts_health_response_invalid")
+    try:
+        payload = json.loads(body)
+    except (UnicodeDecodeError, ValueError) as exc:
+        raise ProbeError("tts_health_json_invalid") from exc
+    return validate_tts_health(
+        payload,
+        provider=provider,
+        model=model,
+        language=language,
+    )
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--component", choices=("all", "stt", "tts"), default="all")
+    parser.add_argument("--stt-url", default=DEFAULT_STT_URL)
+    parser.add_argument("--stt-provider", default=DEFAULT_STT_PROVIDER)
+    parser.add_argument("--stt-model", default=DEFAULT_STT_MODEL)
+    parser.add_argument("--stt-language", default=DEFAULT_STT_LANGUAGE)
+    parser.add_argument("--stt-device", choices=("cpu", "cuda"), default=DEFAULT_STT_DEVICE)
+    parser.add_argument("--tts-url", default=DEFAULT_TTS_URL)
+    parser.add_argument("--tts-provider", default=DEFAULT_TTS_PROVIDER)
+    parser.add_argument("--tts-model", default=DEFAULT_TTS_MODEL)
+    parser.add_argument("--tts-language", default=DEFAULT_TTS_LANGUAGE)
+    parser.add_argument("--timeout-seconds", type=float, default=5.0)
+    return parser
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    args = build_parser().parse_args(list(argv) if argv is not None else None)
+    if not 0.1 <= args.timeout_seconds <= 30:
+        print('{"ok":false,"error":"timeout_invalid"}', file=sys.stderr)
+        return 2
+    result: dict[str, object] = {
+        "schema_version": "vignette.voice-sidecar-readiness.v1",
+        "ok": True,
+    }
+    try:
+        if args.component in {"all", "stt"}:
+            result["stt"] = asyncio.run(
+                probe_stt(
+                    args.stt_url,
+                    provider=args.stt_provider,
+                    model=args.stt_model,
+                    language=args.stt_language,
+                    device=args.stt_device,
+                    timeout_seconds=args.timeout_seconds,
+                )
+            )
+        if args.component in {"all", "tts"}:
+            result["tts"] = probe_tts(
+                args.tts_url,
+                provider=args.tts_provider,
+                model=args.tts_model,
+                language=args.tts_language,
+                timeout_seconds=args.timeout_seconds,
+            )
+    except ProbeError as exc:
+        print(
+            json.dumps(
+                {"ok": False, "component": args.component, "error": str(exc)},
+                separators=(",", ":"),
+            ),
+            file=sys.stderr,
+        )
+        return 1
+    print(json.dumps(result, separators=(",", ":"), sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/register-boot-task.ps1 b/scripts/register-boot-task.ps1
index d3dc0c7..cbef271 100644
--- a/scripts/register-boot-task.ps1
+++ b/scripts/register-boot-task.ps1
@@ -4,21 +4,100 @@
 # actual recovery. Re-run to refresh (-Force). Remove with:
 #   Unregister-ScheduledTask -TaskName VignettePublicRuntime -Confirm:$false
 #
-#   powershell -NoProfile -ExecutionPolicy Bypass -File scripts\register-boot-task.ps1
+#   powershell -NoProfile -ExecutionPolicy Bypass -File scripts\register-boot-task.ps1 `
+#     -StableSourceRoot D:\workspace\vignette-public-runtime-<commit>
+
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$StableSourceRoot,
+  [string]$TaskName = "VignettePublicRuntime"
+)
 
 $ErrorActionPreference = "Stop"
 
-$TaskName = "VignettePublicRuntime"
-$BootScript = "D:\workspace\vignette\scripts\boot-public-runtime.ps1"
+$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
+$RegisterScript = Join-Path $resolvedSourceRoot "scripts\register-boot-task.ps1"
+$BootScript = Join-Path $resolvedSourceRoot "scripts\boot-public-runtime.ps1"
+$StartScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
 $UserName = "$env:USERDOMAIN\$env:USERNAME"
 
-if (-not (Test-Path -LiteralPath $BootScript)) {
-  throw "boot script not found: $BootScript"
+function Invoke-GitText {
+  param([string[]]$Arguments)
+
+  $value = & git.exe -C $resolvedSourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
 }
 
+foreach ($requiredScript in @($RegisterScript, $BootScript, $StartScript)) {
+  if (-not (Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
+    throw "Public runtime script not found: $requiredScript"
+  }
+}
+
+$runningRegisterScript = (Resolve-Path -LiteralPath $PSCommandPath).Path
+if (-not [string]::Equals(
+    $runningRegisterScript,
+    (Resolve-Path -LiteralPath $RegisterScript).Path,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Boot task registrar is not executing from the pinned stable source root"
+}
+
+$gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
+$resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+if (-not [string]::Equals(
+    $resolvedGitRoot,
+    $resolvedSourceRoot,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Stable source root does not match its Git toplevel"
+}
+
+$symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+$symbolicHeadExit = $LASTEXITCODE
+if ($symbolicHeadExit -eq 0) {
+  throw "Stable source must be a detached HEAD, not branch $symbolicHead"
+}
+if ($symbolicHeadExit -ne 1) {
+  throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+}
+
+$dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+if ($dirty) {
+  throw "Stable source is not clean; refusing boot task registration"
+}
+foreach ($relativePath in @(
+  "scripts/register-boot-task.ps1",
+  "scripts/boot-public-runtime.ps1",
+  "scripts/start-public-runtime.ps1"
+)) {
+  Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
+}
+
+$sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
+$sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+$bootScriptSha256 = (Get-FileHash -LiteralPath $BootScript -Algorithm SHA256).Hash.ToLowerInvariant()
+$startScriptSha256 = (Get-FileHash -LiteralPath $StartScript -Algorithm SHA256).Hash.ToLowerInvariant()
+
+$bootArguments = @(
+  "-NoProfile",
+  "-ExecutionPolicy Bypass",
+  "-WindowStyle Hidden",
+  "-File `"$BootScript`"",
+  "-StableSourceRoot `"$resolvedSourceRoot`"",
+  "-ExpectedSourceCommit $sourceCommit",
+  "-ExpectedSourceTree $sourceTree",
+  "-ExpectedBootScriptSha256 $bootScriptSha256",
+  "-ExpectedStartScriptSha256 $startScriptSha256"
+)
+
 $action = New-ScheduledTaskAction `
   -Execute "powershell.exe" `
-  -Argument ("-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"" + $BootScript + "`"")
+  -Argument ($bootArguments -join " ") `
+  -WorkingDirectory $resolvedSourceRoot
 
 $trigger = New-ScheduledTaskTrigger -AtLogOn -User $UserName
 
@@ -41,7 +120,7 @@ Register-ScheduledTask `
   -Trigger $trigger `
   -Principal $principal `
   -Settings $settings `
-  -Description "Vignette public runtime auto-recovery (Docker + postgres + engine/api + cloudflared) at logon" `
+  -Description "Vignette public runtime auto-recovery from detached clean commit $sourceCommit at logon" `
   -Force | Out-Null
 
 $task = Get-ScheduledTask -TaskName $TaskName
@@ -50,6 +129,8 @@ Write-Output ("State      : " + $task.State)
 Write-Output ("User       : " + $principal.UserId)
 Write-Output ("Trigger    : AtLogOn (" + $UserName + ")")
 Write-Output ("Command    : " + $action.Execute + " " + $action.Argument)
+Write-Output ("Source     : root=" + $resolvedSourceRoot + " commit=" + $sourceCommit + " tree=" + $sourceTree)
+Write-Output ("Hashes     : boot=" + $bootScriptSha256 + " start=" + $startScriptSha256)
 Write-Output ""
-Write-Output ("Run now    : powershell -NoProfile -ExecutionPolicy Bypass -File " + $BootScript)
+Write-Output ("Run now    : " + $action.Execute + " " + $action.Argument)
 Write-Output ("Unregister : Unregister-ScheduledTask -TaskName " + $TaskName + " -Confirm:`$false")
diff --git a/scripts/run-g7-external-proof-window.py b/scripts/run-g7-external-proof-window.py
index 63262da..782c592 100644
--- a/scripts/run-g7-external-proof-window.py
+++ b/scripts/run-g7-external-proof-window.py
@@ -8,7 +8,9 @@
 이 스크립트가 하는 일:
 
 1. soak / runtime / topology 캡처를 **동시에** 시작하고 전부 끝날 때까지 기다린다.
-2. 세 캡처가 같은 public host 를 보는지 시작 전에 확인한다(fail-closed).
+2. WSS / admin / topology transport 가 같은 public API host 를 보는지 시작 전에
+   확인한다(fail-closed). 브라우저 ``Origin`` 은 API host 와 섞지 않고 별도
+   allowlist 로 검증한다.
 3. 끝나면 human voice-gain pack 을 더해 `check-g7-external-proof.py` 를 그대로 돌린다.
 
 이 스크립트는 게이트를 **약화시키지 않는다**. 물리 마이크 캡처는 `--confirm-physical-capture` 와
@@ -16,14 +18,20 @@
 실제 참가자와 독립 평가자가 있어야 한다.
 
 `--rehearse` 는 마이크·사람 없이 배관만 확인하는 모드다. 짧은 시간창으로 세 러너를 실제로 띄워
-인자·경로·산출 파일까지 검증하되, soak 은 `--preflight-only` 로 돌려 장치를 열지 않는다. 실제 50분
-실행 전에 이걸로 먼저 실패를 뽑아내라.
+인자·경로·산출 파일까지 검증하되, soak 은 `--preflight-only` 로 돌려 장치를 열지 않는다. 실제 실행은
+52분을 캡처해 시작 skew 를 제외한 유효 교집합 50분을 증명한다. 그 전에 이걸로 먼저 실패를 뽑아내라.
+
+공개 기본 계약은 브라우저 ``Origin=https://vignette.chanpaca.net`` 과 transport
+host ``api-vignette.chanpaca.net`` 이 의도적으로 다른 구성이다. 인증 WSS 의
+``ready`` 는 기본적으로 ``local_whisper/small`` 과 ``melotts/melotts-korean`` 을
+정확히 반환해야 한다.
 """
 
 from __future__ import annotations
 
 import argparse
 import json
+import math
 import subprocess
 import sys
 from concurrent.futures import ThreadPoolExecutor
@@ -40,7 +48,20 @@ RUNTIME_SCRIPT = SCRIPTS / "capture-g7-runtime-evidence.py"
 TOPOLOGY_SCRIPT = SCRIPTS / "capture-g7-topology-evidence.py"
 CHECKER_SCRIPT = SCRIPTS / "check-g7-external-proof.py"
 
-MIN_PRODUCTION_SECONDS = 3_000.0
+DEFAULT_WSS_URL = "wss://api-vignette.chanpaca.net/voice/ws"
+DEFAULT_BROWSER_ORIGIN = "https://vignette.chanpaca.net"
+DEFAULT_ADMIN_RUNTIME_URL = (
+    "https://api-vignette.chanpaca.net/admin/voice-runtime"
+)
+DEFAULT_ALLOWED_BROWSER_ORIGINS = (DEFAULT_BROWSER_ORIGIN,)
+
+# canonical checker 가 요구하는 실제 artifact 교집합은 3,000초다. 세 캡처의
+# 시작 skew 와 마지막 sampler tick 때문에 실제 캡처는 최소 120초 더 길게 잡는다.
+MIN_REQUIRED_OVERLAP_SECONDS = 3_000.0
+CAPTURE_START_SKEW_MARGIN_SECONDS = 120.0
+MIN_PRODUCTION_SECONDS = (
+    MIN_REQUIRED_OVERLAP_SECONDS + CAPTURE_START_SKEW_MARGIN_SECONDS
+)
 RUNTIME_SAMPLE_MARGIN = 1
 
 
@@ -73,21 +94,82 @@ def host_of(url: str) -> str:
 
 
 def assert_single_host(*urls: str) -> str:
-    """세 캡처가 같은 public host 를 보는지 확인한다."""
+    """transport URL 들이 같은 public host 를 보는지 확인한다."""
 
     hosts = {host_of(url) for url in urls if url}
     hosts.discard("")
     if len(hosts) != 1:
-        raise WindowError(f"hosts_must_match:{sorted(hosts)}")
+        # URL, query, tenant 이름을 오류에 반사하지 않는다.
+        raise WindowError("transport_hosts_must_match")
     return hosts.pop()
 
 
+def assert_transport_schemes(wss_url: str, admin_runtime_url: str) -> None:
+    """공개 proof transport 를 암호화된 WSS/HTTPS 로만 고정한다."""
+
+    from urllib.parse import urlsplit
+
+    try:
+        wss = urlsplit(wss_url)
+        admin = urlsplit(admin_runtime_url)
+    except ValueError as exc:
+        raise WindowError("transport_url_invalid") from exc
+    if wss.scheme.lower() != "wss" or not wss.hostname:
+        raise WindowError("wss_url_scheme_invalid")
+    if admin.scheme.lower() != "https" or not admin.hostname:
+        raise WindowError("admin_runtime_url_scheme_invalid")
+
+
+def normalize_browser_origin(value: str) -> str:
+    """브라우저 Origin 직렬화만 허용하고 안전하게 정규화한다."""
+
+    from urllib.parse import urlsplit
+
+    try:
+        parsed = urlsplit(value)
+        port = parsed.port
+    except ValueError as exc:
+        raise WindowError("browser_origin_invalid") from exc
+    if (
+        parsed.scheme.lower() != "https"
+        or not parsed.hostname
+        or parsed.username is not None
+        or parsed.password is not None
+        or parsed.path not in ("", "/")
+        or parsed.query
+        or parsed.fragment
+    ):
+        raise WindowError("browser_origin_invalid")
+    host = parsed.hostname.lower()
+    authority = host if port in (None, 443) else f"{host}:{port}"
+    return f"https://{authority}"
+
+
+def assert_browser_origin_allowed(
+    origin: str, allowed_origins: Sequence[str] | None
+) -> str:
+    """실제 브라우저 Origin 을 transport host 와 독립된 allowlist 로 검증한다."""
+
+    # CLI 옵션은 기본 공개 frontend 를 대체하지 않고 추가한다.
+    configured = (*DEFAULT_ALLOWED_BROWSER_ORIGINS, *(allowed_origins or ()))
+    try:
+        normalized_allowed = {normalize_browser_origin(item) for item in configured}
+    except WindowError as exc:
+        raise WindowError("browser_origin_allowlist_invalid") from exc
+    normalized = normalize_browser_origin(origin)
+    if normalized not in normalized_allowed:
+        # 입력 Origin 을 반사하면 query/PII 가 로그에 남을 수 있으므로 코드만 낸다.
+        raise WindowError("browser_origin_not_allowed")
+    return normalized
+
+
 def sample_plan(duration_seconds: float, interval_seconds: float) -> int:
     """시간창을 덮기에 충분한 샘플 수. 모자라면 겹침 검증이 깨진다."""
 
     if duration_seconds <= 0 or interval_seconds <= 0:
         raise WindowError("invalid_sampling_plan")
-    return int(duration_seconds // interval_seconds) + RUNTIME_SAMPLE_MARGIN
+    # t=0 샘플과 duration 끝을 덮는 종료 샘플을 모두 포함한다.
+    return math.ceil(duration_seconds / interval_seconds) + RUNTIME_SAMPLE_MARGIN
 
 
 def build_soak_leg(args: argparse.Namespace, output: Path) -> Leg:
@@ -153,18 +235,10 @@ def build_topology_leg(args: argparse.Namespace, output: Path) -> Leg:
         "-X",
         "utf8",
         str(TOPOLOGY_SCRIPT),
-        "--compose-project",
-        args.compose_project,
+        "--topology-mode",
+        args.topology_mode,
         "--public-host",
         host_of(args.wss_url),
-        "--api-container",
-        args.api_container,
-        "--api-image-digest",
-        args.api_image_digest,
-        "--caddy-container",
-        args.caddy_container,
-        "--caddy-image-digest",
-        args.caddy_image_digest,
         "--samples",
         str(samples),
         "--interval-seconds",
@@ -172,6 +246,54 @@ def build_topology_leg(args: argparse.Namespace, output: Path) -> Leg:
         "--evidence-output",
         str(output),
     ]
+    if args.topology_mode == "linux-compose":
+        argv += [
+            "--compose-project",
+            args.compose_project,
+            "--api-container",
+            args.api_container,
+            "--api-image-digest",
+            args.api_image_digest,
+            "--caddy-container",
+            args.caddy_container,
+            "--caddy-image-digest",
+            args.caddy_image_digest,
+        ]
+    else:
+        argv += [
+            "--repo-root",
+            args.repo_root,
+            "--git-sha",
+            args.git_sha,
+            "--git-tree-sha",
+            args.git_tree_sha,
+            "--runner-script-sha256",
+            args.runner_script_sha256,
+            "--collector-script-sha256",
+            args.collector_script_sha256,
+            "--checker-script-sha256",
+            args.checker_script_sha256,
+            "--psutil-version",
+            args.psutil_version,
+            "--api-pid",
+            str(args.api_pid),
+            "--api-executable-name",
+            args.api_executable_name,
+            "--api-executable-sha256",
+            args.api_executable_sha256,
+            "--api-cwd",
+            args.api_cwd,
+            "--api-listen-port",
+            str(args.api_listen_port),
+            "--cloudflared-pid",
+            str(args.cloudflared_pid),
+            "--cloudflared-executable-name",
+            args.cloudflared_executable_name,
+            "--cloudflared-executable-sha256",
+            args.cloudflared_executable_sha256,
+            "--cloudflared-cwd",
+            args.cloudflared_cwd,
+        ]
     return Leg("topology", argv, output)
 
 
@@ -237,7 +359,9 @@ def plan_legs(
     *,
     admin_probe: Callable[[str], Sequence[str]] | None = None,
 ) -> list[Leg]:
-    assert_single_host(args.wss_url, args.origin, args.admin_runtime_url)
+    assert_transport_schemes(args.wss_url, args.admin_runtime_url)
+    assert_single_host(args.wss_url, args.admin_runtime_url)
+    assert_browser_origin_allowed(args.origin, args.allowed_browser_origins)
     assert_admin_endpoint_deployed(args.admin_runtime_url, paths_probe=admin_probe)
     return [
         build_soak_leg(args, out_dir / "voice-soak.json"),
@@ -306,6 +430,10 @@ def summarize(
     rehearse: bool,
     checker_returncode: int | None,
 ) -> dict[str, Any]:
+    all_legs_passed = all(r.ok for r in results)
+    gate_closed = (
+        all_legs_passed and checker_returncode == 0 and not rehearse
+    )
     return {
         "schema_version": "vignette.g7-external-proof-window.v1",
         "mode": "rehearse" if rehearse else "production",
@@ -313,9 +441,9 @@ def summarize(
             {"name": r.name, "returncode": r.returncode, "evidence": str(r.output)}
             for r in results
         ],
-        "all_legs_passed": all(r.ok for r in results),
+        "all_legs_passed": all_legs_passed,
         "checker_returncode": checker_returncode,
-        "gate_closed": checker_returncode == 0 and not rehearse,
+        "gate_closed": gate_closed,
         "note": (
             "rehearse 는 배관만 확인한다. 게이트는 실제 물리 마이크 50분 실행과 "
             "독립 human voice-gain pack 이 있어야 닫힌다."
@@ -325,23 +453,86 @@ def summarize(
     }
 
 
+def process_exit_code(report: dict[str, Any]) -> int:
+    """프로세스 성공을 실제 gate closure 에 fail-closed 결속한다."""
+
+    if report.get("mode") == "production":
+        return 0 if (
+            report.get("checker_returncode") == 0
+            and report.get("gate_closed") is True
+        ) else 1
+    return 0 if report.get("all_legs_passed") is True else 1
+
+
 def build_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--wss-url", required=True)
-    parser.add_argument("--origin", required=True)
-    parser.add_argument("--admin-runtime-url", required=True)
-    parser.add_argument("--compose-project", required=True)
-    parser.add_argument("--api-container", required=True)
-    parser.add_argument("--api-image-digest", required=True)
-    parser.add_argument("--caddy-container", required=True)
-    parser.add_argument("--caddy-image-digest", required=True)
+    parser = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=(
+            "공개 기본값:\n"
+            "  browser Origin  https://vignette.chanpaca.net\n"
+            "  WSS transport   wss://api-vignette.chanpaca.net/voice/ws\n"
+            "  admin transport https://api-vignette.chanpaca.net/admin/voice-runtime\n"
+            "인증 WSS ready 기대값:\n"
+            "  stt_provider=local_whisper stt_model=small\n"
+            "  tts_provider=melotts tts_model=melotts-korean\n"
+            "실제 캡처 기본값: 3120초(유효 교집합 최소 3000초 + skew margin 120초)\n"
+            "추가 frontend Origin 은 --allowed-browser-origin 을 반복 지정한다."
+        ),
+    )
+    parser.add_argument("--wss-url", default=DEFAULT_WSS_URL)
+    parser.add_argument(
+        "--origin",
+        default=DEFAULT_BROWSER_ORIGIN,
+        help="WebSocket Origin 헤더에 넣을 실제 브라우저 HTTPS origin",
+    )
+    parser.add_argument(
+        "--allowed-browser-origin",
+        dest="allowed_browser_origins",
+        action="append",
+        help=(
+            "허용할 브라우저 HTTPS origin. 반복 가능하며 생략 시 공개 frontend만 허용"
+        ),
+    )
+    parser.add_argument("--admin-runtime-url", default=DEFAULT_ADMIN_RUNTIME_URL)
+    parser.add_argument(
+        "--topology-mode",
+        choices=("linux-compose", "windows-host"),
+        default="linux-compose",
+    )
+    parser.add_argument("--compose-project")
+    parser.add_argument("--api-container")
+    parser.add_argument("--api-image-digest")
+    parser.add_argument("--caddy-container")
+    parser.add_argument("--caddy-image-digest")
+    parser.add_argument("--repo-root")
+    parser.add_argument("--git-sha")
+    parser.add_argument("--git-tree-sha")
+    parser.add_argument("--runner-script-sha256")
+    parser.add_argument("--collector-script-sha256")
+    parser.add_argument("--checker-script-sha256")
+    parser.add_argument("--psutil-version")
+    parser.add_argument("--api-pid", type=int)
+    parser.add_argument("--api-executable-name")
+    parser.add_argument("--api-executable-sha256")
+    parser.add_argument("--api-cwd")
+    parser.add_argument("--api-listen-port", type=int)
+    parser.add_argument("--cloudflared-pid", type=int)
+    parser.add_argument("--cloudflared-executable-name")
+    parser.add_argument("--cloudflared-executable-sha256")
+    parser.add_argument("--cloudflared-cwd")
     parser.add_argument("--expected-stt-provider", default="local_whisper")
-    parser.add_argument("--expected-stt-model", default="large-v3")
+    parser.add_argument("--expected-stt-model", default="small")
     parser.add_argument("--expected-tts-provider", default="melotts")
     parser.add_argument("--expected-tts-model", default="melotts-korean")
     parser.add_argument("--microphone-device", default="")
     parser.add_argument("--confirm-physical-capture", action="store_true")
-    parser.add_argument("--duration-seconds", type=float, default=MIN_PRODUCTION_SECONDS)
+    parser.add_argument(
+        "--duration-seconds",
+        type=float,
+        default=MIN_PRODUCTION_SECONDS,
+        help="실제 캡처는 최소 3120초; 유효 artifact 교집합 기준은 3000초",
+    )
     parser.add_argument("--runtime-interval-seconds", type=float, default=100.0)
     parser.add_argument("--topology-interval-seconds", type=float, default=100.0)
     parser.add_argument("--human-voice-gain", type=Path)
@@ -359,6 +550,39 @@ def validate(args: argparse.Namespace) -> None:
         raise WindowError("production_window_too_short")
     if not args.rehearse and args.human_voice_gain is None:
         raise WindowError("human_voice_gain_pack_required")
+    if args.topology_mode not in ("linux-compose", "windows-host"):
+        raise WindowError("topology_mode_invalid")
+    if args.topology_mode == "linux-compose":
+        required = (
+            "compose_project",
+            "api_container",
+            "api_image_digest",
+            "caddy_container",
+            "caddy_image_digest",
+        )
+    else:
+        required = (
+            "repo_root",
+            "git_sha",
+            "git_tree_sha",
+            "runner_script_sha256",
+            "collector_script_sha256",
+            "checker_script_sha256",
+            "psutil_version",
+            "api_pid",
+            "api_executable_name",
+            "api_executable_sha256",
+            "api_cwd",
+            "api_listen_port",
+            "cloudflared_pid",
+            "cloudflared_executable_name",
+            "cloudflared_executable_sha256",
+            "cloudflared_cwd",
+        )
+    for field in required:
+        value = getattr(args, field)
+        if value is None or (isinstance(value, str) and not value.strip()):
+            raise WindowError(f"topology_argument_required:{field.replace('_', '-')}")
 
 
 def main(argv: Iterable[str] | None = None) -> int:
@@ -390,7 +614,7 @@ def main(argv: Iterable[str] | None = None) -> int:
         results, rehearse=args.rehearse, checker_returncode=checker_returncode
     )
     print(json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True))
-    return 0 if report["all_legs_passed"] else 1
+    return process_exit_code(report)
 
 
 if __name__ == "__main__":  # pragma: no cover - CLI
diff --git a/scripts/run-outcome-os-release-agent.py b/scripts/run-outcome-os-release-agent.py
index 9e32d35..dbfb837 100644
--- a/scripts/run-outcome-os-release-agent.py
+++ b/scripts/run-outcome-os-release-agent.py
@@ -2,7 +2,8 @@
 """Fail-closed G8 release agent for the isolated Vignette NAS preview.
 
 The default is a read-only dry run.  ``--execute`` is intentionally narrow:
-it accepts only the dedicated Tailnet preview, builds a clean HEAD+patch
+it accepts only the dedicated Tailnet preview, builds either the default
+verified HEAD+patch candidate or an explicitly requested clean-HEAD archive
 candidate, runs release/API/Web/session gates, snapshots the current API and
 Web images, promotes only a changed deterministic SHA, and rolls back the
 previous images when any post-promotion proof fails.
@@ -54,6 +55,7 @@ SSOT_REQUIRED_PATHS = (
 # operator surface has exercised its browser contract.  Keep this list explicit
 # so a newly added goal cannot disappear behind a broad directory glob.
 RELEASE_UI_E2E_SPECS = (
+    "e2e/insecure-context-uuid.spec.ts",
     "e2e/session-layout.spec.ts",
     "e2e/session-persistence.spec.ts",
     "e2e/self-directed-learning-loop.spec.ts",
@@ -66,6 +68,36 @@ RELEASE_UI_E2E_SPECS = (
     "e2e/multimodal-alliance.spec.ts",
     "e2e/continuous-improvement-admin.spec.ts",
 )
+# The UUID source-contract spec intentionally imports ``/src/lib/uuid.ts`` and
+# scans the local source tree, so it belongs to the Vite candidate gate above.
+# A production NAS build serves the SPA HTML for ``/src/*``.  The postdeploy
+# gate therefore exercises the exact built review routes that previously
+# crashed on insecure HTTP, while retaining every production-origin-compatible
+# release spec.  The real returned-practice DB closed loop remains an explicit
+# disposable-DB-only gate and must never be silently skipped against NAS.
+POSTDEPLOY_NAS_E2E_SPECS = (
+    "e2e/session-layout.spec.ts",
+    "e2e/session-persistence.spec.ts",
+    "e2e/self-directed-learning-loop.spec.ts",
+    "e2e/alliance-pulse.spec.ts",
+    "e2e/outcome-trajectory.spec.ts",
+    "e2e/rupture-repair.spec.ts",
+    "e2e/deliberate-practice.spec.ts",
+    "e2e/calibration-transfer.spec.ts",
+    "e2e/supervision-research.spec.ts",
+    "e2e/multimodal-alliance.spec.ts",
+    "e2e/continuous-improvement-admin.spec.ts",
+)
+POSTDEPLOY_SOURCE_ONLY_E2E_SPECS = ("e2e/insecure-context-uuid.spec.ts",)
+POSTDEPLOY_DISPOSABLE_DB_E2E_SPECS = (
+    "e2e/returned-practice-db-closed-loop.spec.ts",
+)
+SOURCE_ONLY_E2E_PORT = 5198
+RELEASE_BROWSER_PROJECTS = (
+    "chromium-desktop",
+    "chromium-mobile",
+    "chromium-single-run",
+)
 RELEASE_E2E_TIMEOUT_SECONDS = 15 * 60
 
 # Existing preview volumes do not replay docker-entrypoint-initdb.d.  These
@@ -100,8 +132,10 @@ REQUIRED_OPENAPI_PATHS = {
 
 IMAGE_ID_RE = re.compile(r"^sha256:[a-f0-9]{64}$")
 SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
+GIT_OBJECT_RE = re.compile(r"^(?:[a-f0-9]{40}|[a-f0-9]{64})$")
 SSH_TARGET_RE = re.compile(r"^(?:[A-Za-z0-9._-]+@)?100\.116\.83\.60$")
 RELEASE_KEY_RE = re.compile(r"^[a-f0-9]{16}-\d{8}T\d{6}Z-\d+$")
+SOURCE_MODES = ("patch", "clean-head")
 
 
 @dataclass(frozen=True)
@@ -147,6 +181,7 @@ class ReleaseAgentConfig:
     repo_root: Path = REPO_ROOT
     manifest_path: Path = DEFAULT_MANIFEST
     hunk_map_path: Path = DEFAULT_HUNK_MAP
+    source_mode: str = "patch"
     execute: bool = False
     milestone: MaterialMilestone | None = None
     target: DeploymentTarget = NAS_PREVIEW_TARGET
@@ -215,6 +250,8 @@ class RuntimeProbe(Protocol):
 class CandidateManager(Protocol):
     def materialize(self, base_commit: str, patch_path: str) -> Path: ...
 
+    def materialize_archive(self, archive_path: Path, expected_sha256: str) -> Path: ...
+
     def cleanup(self) -> None: ...
 
 
@@ -226,6 +263,16 @@ def sha256_bytes(value: bytes) -> str:
     return hashlib.sha256(value).hexdigest()
 
 
+def sha256_file(path: Path) -> tuple[str, int]:
+    digest = hashlib.sha256()
+    size = 0
+    with path.open("rb") as source:
+        while chunk := source.read(1024 * 1024):
+            digest.update(chunk)
+            size += len(chunk)
+    return digest.hexdigest(), size
+
+
 def validate_target(target: DeploymentTarget) -> None:
     if target != NAS_PREVIEW_TARGET:
         raise ValueError(
@@ -237,6 +284,15 @@ def validate_target(target: DeploymentTarget) -> None:
         raise ValueError("isolated NAS preview root must be an absolute canonical path")
 
 
+def validate_source_repo_root(repo_root: Path) -> None:
+    if not repo_root.is_absolute():
+        raise StageFailure("source_repository", "source repository root must be absolute")
+    if not repo_root.exists():
+        raise StageFailure("source_repository", "source repository root does not exist")
+    if not repo_root.is_dir():
+        raise StageFailure("source_repository", "source repository root is not a directory")
+
+
 def validate_required_release_payload(manifest: dict[str, Any]) -> None:
     classifications = manifest.get("classifications")
     related = classifications.get("related") if isinstance(classifications, dict) else None
@@ -437,6 +493,45 @@ class CleanCandidateManager:
             _normalize_candidate_file_to_lf(shell_script, "shell script")
         return root
 
+    def materialize_archive(self, archive_path: Path, expected_sha256: str) -> Path:
+        """Extract an exact clean-HEAD archive without applying a patch."""
+
+        if not SHA256_RE.fullmatch(expected_sha256):
+            raise StageFailure("candidate_archive_binding", "expected archive SHA is invalid")
+        try:
+            actual_sha256, _ = sha256_file(archive_path)
+        except OSError as exc:
+            raise StageFailure("candidate_archive_binding", str(exc)) from exc
+        if actual_sha256 != expected_sha256:
+            raise StageFailure(
+                "candidate_archive_binding",
+                f"archive SHA drifted: expected={expected_sha256} actual={actual_sha256}",
+            )
+
+        self._temp = tempfile.TemporaryDirectory(prefix="vignette-release-agent-")
+        root = Path(self._temp.name) / "candidate"
+        try:
+            root.mkdir(parents=True)
+            with tarfile.open(archive_path, "r:") as archive:
+                _safe_extract(archive, root)
+            generated_api = root / "apps/web/src/lib/api.gen.ts"
+            if not generated_api.is_file():
+                raise StageFailure("candidate_archive", "generated API contract is missing")
+            # git archive stores canonical LF blobs, while a Windows checkout can
+            # materialize this generated file with CRLF.  openapi-typescript
+            # --check compares bytes, so apply the same platform normalization as
+            # patch-mode after the archive SHA has already been verified.
+            _normalize_candidate_file_to_lf(generated_api, "generated API contract")
+            for shell_script in sorted(root.rglob("*.sh")):
+                _normalize_candidate_file_to_lf(shell_script, "shell script")
+        except StageFailure:
+            self.cleanup()
+            raise
+        except (OSError, tarfile.TarError) as exc:
+            self.cleanup()
+            raise StageFailure("candidate_archive", str(exc)) from exc
+        return root
+
     def cleanup(self) -> None:
         if self._temp is not None:
             self._temp.cleanup()
@@ -970,6 +1065,8 @@ class ReleaseAgent:
         self.runtime_probe = runtime_probe
         self.candidate_manager = candidate_manager
         self.stage_evidence: list[dict[str, Any]] = []
+        self.source_evidence: dict[str, Any] | None = None
+        self._source_temp: tempfile.TemporaryDirectory[str] | None = None
 
     def _run(
         self,
@@ -1089,6 +1186,152 @@ class ReleaseAgent:
             raise StageFailure("release_determinism", "builder patch SHA is invalid")
         return reports[1]
 
+    def _clean_head_identity(self, suffix: str) -> tuple[str, str]:
+        status = self._run(
+            f"clean_head_worktree_{suffix}",
+            ["git", "status", "--porcelain=v1", "--untracked-files=no"],
+            cwd=self.config.repo_root,
+            timeout=120,
+        )
+        if status.stdout.strip():
+            raise StageFailure(
+                "clean_head_worktree",
+                "tracked worktree/index changes are forbidden in clean-head mode",
+            )
+
+        head_result = self._run(
+            f"clean_head_head_{suffix}",
+            ["git", "rev-parse", "--verify", "HEAD"],
+            cwd=self.config.repo_root,
+            timeout=120,
+        )
+        tree_result = self._run(
+            f"clean_head_tree_{suffix}",
+            ["git", "rev-parse", "--verify", "HEAD^{tree}"],
+            cwd=self.config.repo_root,
+            timeout=120,
+        )
+        head = head_result.stdout.strip()
+        tree = tree_result.stdout.strip()
+        if not GIT_OBJECT_RE.fullmatch(head):
+            raise StageFailure("clean_head_identity", "Git HEAD is invalid")
+        if not GIT_OBJECT_RE.fullmatch(tree):
+            raise StageFailure("clean_head_identity", "Git tree is invalid")
+        return head, tree
+
+    def _validate_clean_head_worktree_root(self) -> None:
+        result = self._run(
+            "clean_head_repository",
+            ["git", "rev-parse", "--show-toplevel"],
+            cwd=self.config.repo_root,
+            timeout=120,
+        )
+        reported_root = result.stdout.strip()
+        if not reported_root:
+            raise StageFailure("clean_head_repository", "Git worktree root is missing")
+        try:
+            actual_root = Path(reported_root).resolve(strict=True)
+            expected_root = self.config.repo_root.resolve(strict=True)
+        except OSError as exc:
+            raise StageFailure("clean_head_repository", str(exc)) from exc
+        if actual_root != expected_root:
+            raise StageFailure(
+                "clean_head_repository",
+                f"source repository is not the Git worktree root: {actual_root}",
+            )
+
+    def _build_clean_head_source_twice(self) -> dict[str, Any]:
+        self._validate_clean_head_worktree_root()
+        before_head, before_tree = self._clean_head_identity("before")
+        self._source_temp = tempfile.TemporaryDirectory(prefix="vignette-release-source-")
+        source_root = Path(self._source_temp.name)
+        archives: list[Path] = []
+        archive_reports: list[dict[str, Any]] = []
+        for run_number in (1, 2):
+            archive_path = source_root / f"clean-head-{run_number}.tar"
+            self._run(
+                f"clean_head_archive_run_{run_number}",
+                [
+                    "git",
+                    "archive",
+                    "--format=tar",
+                    "--output",
+                    str(archive_path),
+                    before_head,
+                ],
+                cwd=self.config.repo_root,
+                timeout=900,
+            )
+            try:
+                archive_sha256, archive_size = sha256_file(archive_path)
+            except OSError as exc:
+                raise StageFailure("clean_head_archive", str(exc)) from exc
+            archives.append(archive_path)
+            archive_reports.append(
+                {
+                    "sha256": archive_sha256,
+                    "bytes": archive_size,
+                }
+            )
+
+        after_head, after_tree = self._clean_head_identity("after")
+        if (before_head, before_tree) != (after_head, after_tree):
+            raise StageFailure(
+                "clean_head_identity",
+                "Git HEAD/tree changed while clean-head archives were built",
+            )
+        if archive_reports[0] != archive_reports[1]:
+            raise StageFailure(
+                "clean_head_determinism",
+                f"two clean-head archives differ: {archive_reports}",
+            )
+        archive_sha256 = archive_reports[1]["sha256"]
+        if not SHA256_RE.fullmatch(archive_sha256):
+            raise StageFailure("clean_head_determinism", "archive SHA is invalid")
+        return {
+            "source_mode": "clean-head",
+            "head": after_head,
+            "tree": after_tree,
+            "archive_sha256": archive_sha256,
+            "archive_bytes": archive_reports[1]["bytes"],
+            "archive_path": archives[1],
+            "deterministic_runs": 2,
+        }
+
+    def _prepare_source(self) -> tuple[dict[str, Any], str]:
+        if self.config.source_mode == "patch":
+            release = self._build_release_twice()
+            self._check_manifest_binding(release)
+            self.source_evidence = {
+                "repo_root": str(self.config.repo_root),
+                "base_commit": release["base_commit"],
+                "patch": {
+                    "sha256": release["patch_sha256"],
+                    "bytes": release["patch_bytes"],
+                    "files": release["patch_files"],
+                    "output": release["output_patch"],
+                    "deterministic_runs": 2,
+                },
+            }
+            return release, release["patch_sha256"]
+        if self.config.source_mode == "clean-head":
+            release = self._build_clean_head_source_twice()
+            self.source_evidence = {
+                "repo_root": str(self.config.repo_root),
+                "head": release["head"],
+                "tree": release["tree"],
+                "archive": {
+                    "sha256": release["archive_sha256"],
+                    "bytes": release["archive_bytes"],
+                    "deterministic_runs": release["deterministic_runs"],
+                },
+            }
+            return release, release["archive_sha256"]
+        raise StageFailure(
+            "configuration",
+            f"unsupported source mode: {self.config.source_mode!r}",
+        )
+
     def _check_manifest_binding(self, release: dict[str, Any]) -> None:
         result = self._run(
             "release_manifest",
@@ -1169,6 +1412,33 @@ class ReleaseAgent:
         self._run("web_typecheck", ["npm.cmd", "run", "typecheck"], cwd=web, timeout=300)
         self._run("web_build", ["npm.cmd", "run", "build"], cwd=web, timeout=600)
 
+        # This spec imports /src/lib/uuid.ts and therefore must run against a
+        # source Vite server, not the production Compose build (which correctly
+        # serves the SPA document for /src/*).  CI=1 prevents reuse of an
+        # unrelated long-lived Vite process on the workstation.
+        source_e2e_env = os.environ.copy()
+        source_e2e_env.pop("PLAYWRIGHT_BASE_URL", None)
+        source_e2e_env.pop("PLAYWRIGHT_SKIP_WEB_SERVER", None)
+        source_e2e_env["PLAYWRIGHT_HOST"] = "127.0.0.1"
+        source_e2e_env["PLAYWRIGHT_PORT"] = str(SOURCE_ONLY_E2E_PORT)
+        source_e2e_env["CI"] = "1"
+        self._run(
+            "source_insecure_context_e2e",
+            [
+                "node.exe",
+                str(web / "node_modules/@playwright/test/cli.js"),
+                "test",
+                *POSTDEPLOY_SOURCE_ONLY_E2E_SPECS,
+                "--project=chromium-desktop",
+                "--project=chromium-mobile",
+                "--workers=1",
+                "--reporter=line",
+            ],
+            cwd=web,
+            env=source_e2e_env,
+            timeout=300,
+        )
+
         stack_attempted = False
         stack_env: Path | None = None
         project = candidate_compose_project(desired_sha)
@@ -1207,7 +1477,7 @@ class ReleaseAgent:
                     "node.exe",
                     str(web / "node_modules/@playwright/test/cli.js"),
                     "test",
-                    *RELEASE_UI_E2E_SPECS,
+                    *POSTDEPLOY_NAS_E2E_SPECS,
                     "--project=chromium-desktop",
                     "--project=chromium-mobile",
                     "--project=chromium-single-run",
@@ -1288,20 +1558,29 @@ class ReleaseAgent:
                 "node.exe",
                 str(web / "node_modules/@playwright/test/cli.js"),
                 "test",
-                "e2e/session-persistence.spec.ts",
-                "--project=chromium-single-run",
+                *POSTDEPLOY_NAS_E2E_SPECS,
+                *(f"--project={project}" for project in RELEASE_BROWSER_PROJECTS),
                 "--workers=1",
-                "--grep",
-                "persists the browser SSE stream into DB-backed review",
                 "--reporter=line",
             ],
             cwd=web,
             env=env,
-            timeout=300,
+            timeout=RELEASE_E2E_TIMEOUT_SECONDS,
         )
         return {
             "status": "passed",
-            "test": "session-persistence: browser SSE stream -> DB-backed review",
+            "base_url": self.config.target.base_url,
+            "specs": list(POSTDEPLOY_NAS_E2E_SPECS),
+            "projects": list(RELEASE_BROWSER_PROJECTS),
+            "source_only_candidate_specs": list(POSTDEPLOY_SOURCE_ONLY_E2E_SPECS),
+            "separate_disposable_db_specs": list(POSTDEPLOY_DISPOSABLE_DB_E2E_SPECS),
+            "uuid_runtime_route_specs": [
+                "e2e/session-persistence.spec.ts",
+                "e2e/self-directed-learning-loop.spec.ts",
+                "e2e/rupture-repair.spec.ts",
+                "e2e/deliberate-practice.spec.ts",
+                "e2e/calibration-transfer.spec.ts",
+            ],
             "physical_microphone_used": False,
             "stdout_sha256": sha256_bytes(result.stdout.encode("utf-8")),
         }
@@ -1312,6 +1591,8 @@ class ReleaseAgent:
             "captured_at": utc_now(),
             "ok": False,
             "mode": "execute" if self.config.execute else "dry-run",
+            "source_mode": self.config.source_mode,
+            "source": self.source_evidence,
             "target": asdict(self.config.target),
             "milestone": asdict(self.config.milestone) if self.config.milestone else None,
             "desired_sha": desired_sha,
@@ -1342,10 +1623,9 @@ class ReleaseAgent:
         desired_sha: str | None = None
         try:
             validate_target(self.config.target)
+            validate_source_repo_root(self.config.repo_root)
             validate_milestone(self.config.milestone)
-            release = self._build_release_twice()
-            desired_sha = release["patch_sha256"]
-            self._check_manifest_binding(release)
+            release, desired_sha = self._prepare_source()
             active_state = self.deployment.read_active_state()
             active_sha = active_state.get("active_sha") if active_state else None
             if active_sha is not None and (
@@ -1391,9 +1671,14 @@ class ReleaseAgent:
                     "remote release-agent state is untracked; adopt it only after an image/Compose rollback snapshot audit",
                 )
 
-            candidate = self.candidate_manager.materialize(
-                release["base_commit"], release["output_patch"]
-            )
+            if self.config.source_mode == "clean-head":
+                candidate = self.candidate_manager.materialize_archive(
+                    release["archive_path"], release["archive_sha256"]
+                )
+            else:
+                candidate = self.candidate_manager.materialize(
+                    release["base_commit"], release["output_patch"]
+                )
             self._run_candidate_gates(candidate, desired_sha)
             snapshot = self.deployment.snapshot()
             self._validate_snapshot_binding(active_state, snapshot)
@@ -1472,6 +1757,9 @@ class ReleaseAgent:
         finally:
             if candidate is not None:
                 self.candidate_manager.cleanup()
+            if self._source_temp is not None:
+                self._source_temp.cleanup()
+                self._source_temp = None
 
 
 def load_milestone(path: Path) -> MaterialMilestone:
@@ -1502,6 +1790,18 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--milestone", type=Path, required=True)
     parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
     parser.add_argument("--hunk-map", type=Path, default=DEFAULT_HUNK_MAP)
+    parser.add_argument(
+        "--source-mode",
+        choices=SOURCE_MODES,
+        default="patch",
+        help="Release source: verified patch (default) or exact clean Git HEAD archive",
+    )
+    parser.add_argument(
+        "--source-repo-root",
+        type=Path,
+        default=REPO_ROOT,
+        help="Absolute Git worktree root used as the release source",
+    )
     parser.add_argument("--nas-env-file", type=Path, default=DEFAULT_NAS_ENV)
     parser.add_argument("--evidence-out", type=Path)
     parser.add_argument("--ssh-target", help="Required for live state inspection/execution")
@@ -1560,9 +1860,10 @@ def main(argv: list[str] | None = None) -> int:
         else:
             deployment = StaticDeploymentState(args.current_deployment_sha)
         config = ReleaseAgentConfig(
-            repo_root=REPO_ROOT,
+            repo_root=args.source_repo_root,
             manifest_path=args.manifest,
             hunk_map_path=args.hunk_map,
+            source_mode=args.source_mode,
             execute=args.execute,
             milestone=milestone,
             target=NAS_PREVIEW_TARGET,
@@ -1575,7 +1876,7 @@ def main(argv: list[str] | None = None) -> int:
             runner=runner,
             deployment=deployment,
             runtime_probe=HttpRuntimeProbe(NAS_PREVIEW_TARGET.base_url),
-            candidate_manager=CleanCandidateManager(REPO_ROOT, runner),
+            candidate_manager=CleanCandidateManager(args.source_repo_root, runner),
         )
         report = agent.run()
         if args.json:
diff --git a/scripts/start-local-whisper-stt.ps1 b/scripts/start-local-whisper-stt.ps1
index ac11c49..9a2383f 100644
--- a/scripts/start-local-whisper-stt.ps1
+++ b/scripts/start-local-whisper-stt.ps1
@@ -1,9 +1,9 @@
 param(
   [int]$Port = 9882,
   [ValidateSet('large-v3', 'large-v3-turbo', 'medium', 'small', 'base')]
-  [string]$Model = 'large-v3',
+  [string]$Model = 'small',
   [ValidateSet('auto', 'cuda', 'cpu')]
-  [string]$Device = 'auto',
+  [string]$Device = 'cpu',
   [int]$WaitReadySeconds = 180
 )
 
diff --git a/scripts/start-public-runtime.ps1 b/scripts/start-public-runtime.ps1
index 957ef2c..ebf6a9d 100644
--- a/scripts/start-public-runtime.ps1
+++ b/scripts/start-public-runtime.ps1
@@ -3,6 +3,9 @@
   [int]$ApiPort = 8001,
   [int]$WebPort = 5174,
   [int]$EnginePort = 9099,
+  [int]$WhisperPort = 9882,
+  [int]$MeloTtsPort = 9883,
+  [int]$VoiceSidecarReadySeconds = 300,
   [string]$Python = "$env:LOCALAPPDATA\Programs\Python\Python311\python.exe",
   [string]$Cloudflared = "$env:LOCALAPPDATA\Microsoft\WinGet\Links\cloudflared.exe",
   [string]$CloudflaredConfig = "$env:USERPROFILE\.cloudflared\vignette-config.yml",
@@ -11,7 +14,16 @@
   [switch]$SkipWebRestart,
   [switch]$RouteCloudflareDns,
   [string]$CloudflareTunnelName = "vignette",
-  [switch]$SkipCloudflaredRestart
+  [switch]$SkipCloudflaredRestart,
+  [switch]$RequireFreshPublicProvenance,
+  [string]$ExpectedSourceCommit = "",
+  [string]$ExpectedSourceTree = "",
+  [string]$ExpectedPythonSha256 = "",
+  [string]$ExpectedCloudflaredSha256 = "",
+  [string]$ExpectedCloudflaredConfigSha256 = "",
+  [string]$RuntimeProvenancePath = "",
+  [ValidateRange(1, 60)]
+  [int]$ProcessStopTimeoutSeconds = 15
 )
 
 $ErrorActionPreference = "Stop"
@@ -31,6 +43,16 @@ $EngineOutLog = Join-Path $ApiDir "engine.public.out.log"
 $EngineErrLog = Join-Path $ApiDir "engine.public.err.log"
 $WebOutLog = Join-Path $Workspace "web.public.out.log"
 $WebErrLog = Join-Path $Workspace "web.public.err.log"
+$WhisperStartScript = Join-Path $Workspace "scripts\start-local-whisper-stt.ps1"
+$MeloTtsStartScript = Join-Path $Workspace "scripts\start-melotts.ps1"
+$VoiceSidecarProbe = Join-Path $Workspace "scripts\probe-public-voice-sidecars.py"
+$WhisperModel = "small"
+$WhisperLanguage = "ko"
+$WhisperDevice = "cpu"
+$MeloTtsModel = "melotts-korean"
+$MeloTtsLanguage = "KR"
+$PublicApiHostnames = @("api-vignette.chanpaca.net", "api-vnet.18ka.net")
+$PublicWebHostnames = @("vnet.18ka.net")
 
 function Get-JsonHealth {
   param(
@@ -64,6 +86,76 @@ function Wait-JsonHealth {
   throw "Timed out waiting for healthy response from $Uri"
 }
 
+function Test-PortListener {
+  param([int]$Port)
+
+  $listener = Get-NetTCPConnection `
+    -State Listen `
+    -LocalPort $Port `
+    -ErrorAction SilentlyContinue `
+    | Select-Object -First 1
+  return $null -ne $listener
+}
+
+function Test-VoiceSidecarReady {
+  param(
+    [ValidateSet("stt", "tts")]
+    [string]$Component
+  )
+
+  $probeArgs = @(
+    "-X", "utf8", $VoiceSidecarProbe,
+    "--component", $Component,
+    "--stt-url", "ws://127.0.0.1:$WhisperPort/v1/listen",
+    "--stt-provider", "local_whisper",
+    "--stt-model", $WhisperModel,
+    "--stt-language", $WhisperLanguage,
+    "--stt-device", $WhisperDevice,
+    "--tts-url", "http://127.0.0.1:$MeloTtsPort",
+    "--tts-provider", "melotts",
+    "--tts-model", $MeloTtsModel,
+    "--tts-language", $MeloTtsLanguage,
+    "--timeout-seconds", "5"
+  )
+  & $Python @probeArgs 1>$null 2>$null
+  return $LASTEXITCODE -eq 0
+}
+
+function Wait-VoiceSidecarReady {
+  param(
+    [ValidateSet("stt", "tts")]
+    [string]$Component,
+    [int]$TimeoutSec
+  )
+
+  $deadline = (Get-Date).AddSeconds($TimeoutSec)
+  do {
+    if (Test-VoiceSidecarReady -Component $Component) {
+      return $true
+    }
+    Start-Sleep -Seconds 2
+  } while ((Get-Date) -lt $deadline)
+
+  return $false
+}
+
+function Test-VoiceApiReady {
+  param([object]$Health)
+
+  return (
+    $null -ne $Health -and
+    $Health.status -eq "ok" -and
+    $Health.available -eq $true -and
+    $Health.stt_available -eq $true -and
+    $Health.tts_available -eq $true -and
+    $Health.stt_provider -eq "local_whisper" -and
+    $Health.stt_model -eq $WhisperModel -and
+    $Health.tts_provider -eq "melotts" -and
+    $Health.tts_model -eq $MeloTtsModel -and
+    $Health.limits.uvicorn_ws_max_queue -eq 4
+  )
+}
+
 function Test-EngineReady {
   param(
     [int]$Port,
@@ -124,22 +216,155 @@ function Wait-HttpStatus {
   throw "Timed out waiting for HTTP response from $Uri"
 }
 
+function Stop-ProcessesBounded {
+  param(
+    [object[]]$Processes,
+    [int]$TimeoutSec,
+    [string]$Role
+  )
+
+  $processIds = @(
+    $Processes |
+      ForEach-Object { [int]$_.ProcessId } |
+      Sort-Object -Unique
+  )
+  foreach ($processId in $processIds) {
+    Stop-Process -Id $processId -Force -ErrorAction SilentlyContinue
+  }
+
+  $deadline = (Get-Date).AddSeconds($TimeoutSec)
+  do {
+    $remaining = @(
+      $processIds |
+        Where-Object { $null -ne (Get-Process -Id $_ -ErrorAction SilentlyContinue) }
+    )
+    if ($remaining.Count -eq 0) {
+      return $processIds
+    }
+    Start-Sleep -Milliseconds 200
+  } while ((Get-Date) -lt $deadline)
+
+  throw "Timed out stopping $Role process IDs: $($remaining -join ',')"
+}
+
 function Stop-UvicornByPort {
   param(
     [string]$AppImport,
-    [int]$Port
+    [int]$Port,
+    [int]$TimeoutSec = 15
   )
 
   # Name 조건이 없으면 같은 문자열을 인자로 들고 있는 셸/래퍼 프로세스까지 매칭해
   # 호출자 자신을 죽일 수 있다. 대상은 항상 python 프로세스다.
-  Get-CimInstance Win32_Process |
+  $processes = @(
+    Get-CimInstance Win32_Process |
     Where-Object {
       $_.Name -like "python*" -and
       $_.CommandLine -and
       $_.CommandLine -like "*uvicorn $AppImport*" -and
       $_.CommandLine -like "*--port $Port*"
-    } |
-    ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
+    }
+  )
+  return @(
+    Stop-ProcessesBounded `
+      -Processes $processes `
+      -TimeoutSec $TimeoutSec `
+      -Role "uvicorn $AppImport on port $Port"
+  )
+}
+
+function Get-CloudflaredProcessesForConfig {
+  param(
+    [string]$ConfigPath,
+    [switch]$ExactPath
+  )
+
+  $configLeaf = Split-Path -Leaf $ConfigPath
+  return @(
+    Get-CimInstance Win32_Process |
+      Where-Object {
+        $_.Name -eq "cloudflared.exe" -and
+        $_.CommandLine -and
+        $_.CommandLine -like "*--config*" -and
+        (
+          $_.CommandLine.IndexOf($ConfigPath, [System.StringComparison]::OrdinalIgnoreCase) -ge 0 -or
+          (-not $ExactPath -and $_.CommandLine -like "*$configLeaf*")
+        )
+      }
+  )
+}
+
+function Wait-ProcessIdentity {
+  param(
+    [int]$ProcessId,
+    [string]$Role,
+    [string]$ExpectedCwd,
+    [int]$TimeoutSec = 15
+  )
+
+  $deadline = (Get-Date).AddSeconds($TimeoutSec)
+  do {
+    $process = Get-CimInstance Win32_Process `
+      -Filter "ProcessId = $ProcessId" `
+      -ErrorAction SilentlyContinue
+    if (
+      $null -ne $process -and
+      $process.ExecutablePath -and
+      $process.CommandLine
+    ) {
+      $identityProbeArgs = @(
+        "-X", "utf8", "-c",
+        "import hashlib,psutil,sys; from datetime import UTC,datetime; p=psutil.Process(int(sys.argv[1])); print(p.cwd()); print(datetime.fromtimestamp(p.create_time(), UTC).isoformat().replace('+00:00', 'Z')); print(hashlib.sha256(chr(0).join(p.cmdline()).encode('utf-8', errors='strict')).hexdigest())",
+        "$ProcessId"
+      )
+      $identityProbe = @(& $Python @identityProbeArgs)
+      if ($LASTEXITCODE -ne 0 -or $identityProbe.Count -ne 3) {
+        throw "Could not prove $Role psutil identity for PID $ProcessId"
+      }
+      $actualCwd = $identityProbe[0].Trim()
+      $startedAtUtc = $identityProbe[1].Trim()
+      $commandLineSha256 = $identityProbe[2].Trim().ToLowerInvariant()
+      if (-not $actualCwd -or $startedAtUtc -notmatch "Z$" -or $commandLineSha256 -notmatch "^[0-9a-f]{64}$") {
+        throw "$Role psutil identity is incomplete for PID $ProcessId"
+      }
+      if (-not [string]::Equals(
+          [System.IO.Path]::GetFullPath($actualCwd),
+          [System.IO.Path]::GetFullPath($ExpectedCwd),
+          [System.StringComparison]::OrdinalIgnoreCase
+      )) {
+        throw "$Role working directory drift: expected=$ExpectedCwd actual=$actualCwd"
+      }
+      return [ordered]@{
+        role = $Role
+        pid = [int]$process.ProcessId
+        started_at_utc = $startedAtUtc
+        executable_path = $process.ExecutablePath
+        executable_name = Split-Path -Leaf $process.ExecutablePath
+        executable_sha256 = (Get-FileHash -LiteralPath $process.ExecutablePath -Algorithm SHA256).Hash.ToLowerInvariant()
+        command_line = $process.CommandLine
+        command_line_sha256 = $commandLineSha256
+        cwd = $actualCwd
+      }
+    }
+    Start-Sleep -Milliseconds 200
+  } while ((Get-Date) -lt $deadline)
+
+  throw "Timed out reading $Role process identity for PID $ProcessId"
+}
+
+function ConvertTo-SafeProcessIdentity {
+  param([System.Collections.IDictionary]$Identity)
+
+  # Raw command line이나 executable full path는 config/token을 우발적으로
+  # 영구 보존할 수 있다. topology 결속에 필요한 비밀 비포함 투영만 기록한다.
+  return [ordered]@{
+    pid = [int]$Identity.pid
+    started_at_utc = $Identity.started_at_utc
+    executable_name = $Identity.executable_name
+    executable_sha256 = $Identity.executable_sha256
+    command_line_sha256 = $Identity.command_line_sha256
+    cwd = $Identity.cwd
+  }
 }
 
 function Stop-NodeByPortHint {
@@ -160,13 +385,232 @@ function ConvertTo-CompactJson {
   ConvertTo-Json -InputObject $Value -Compress
 }
 
+function Invoke-StableGitText {
+  param(
+    [string]$SourceRoot,
+    [string[]]$Arguments
+  )
+
+  $value = & git.exe -C $SourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
+}
+
+function Initialize-RuntimeProvenanceOutput {
+  param([string]$OutputPath)
+
+  if (-not [System.IO.Path]::IsPathRooted($OutputPath)) {
+    throw "Fresh public provenance output path must be absolute"
+  }
+
+  try {
+    $resolvedOutputPath = [System.IO.Path]::GetFullPath($OutputPath)
+    $outputDirectory = Split-Path -Parent $resolvedOutputPath
+    if (-not $outputDirectory) {
+      throw "Fresh public provenance output path has no parent directory"
+    }
+    if (Test-Path -LiteralPath $resolvedOutputPath -PathType Container) {
+      throw "Fresh public provenance output path is a directory: $resolvedOutputPath"
+    }
+    if (-not (Test-Path -LiteralPath $outputDirectory -PathType Container)) {
+      New-Item -ItemType Directory -Path $outputDirectory -Force | Out-Null
+    }
+    if (-not (Test-Path -LiteralPath $outputDirectory -PathType Container)) {
+      throw "Fresh public provenance output directory is unavailable: $outputDirectory"
+    }
+
+    # 기존 receipt가 잠겨 있거나 read-only라면 프로세스 교체 전에 실패해야 한다.
+    # sibling probe 두 개를 atomic replace해 디렉터리의 create/flush/replace/delete
+    # 권한도 미리 검증한다. 실제 receipt 내용은 이 단계에서 건드리지 않는다.
+    if (Test-Path -LiteralPath $resolvedOutputPath -PathType Leaf) {
+      $attributes = [System.IO.File]::GetAttributes($resolvedOutputPath)
+      if (($attributes -band [System.IO.FileAttributes]::ReadOnly) -ne 0) {
+        throw "Fresh public provenance output is read-only: $resolvedOutputPath"
+      }
+      $existingStream = [System.IO.File]::Open(
+        $resolvedOutputPath,
+        [System.IO.FileMode]::Open,
+        [System.IO.FileAccess]::ReadWrite,
+        [System.IO.FileShare]::Read
+      )
+      $existingStream.Dispose()
+    }
+
+    $probeId = [Guid]::NewGuid().ToString("N")
+    $probeSource = Join-Path $outputDirectory ".$([System.IO.Path]::GetFileName($resolvedOutputPath)).$probeId.source.tmp"
+    $probeTarget = Join-Path $outputDirectory ".$([System.IO.Path]::GetFileName($resolvedOutputPath)).$probeId.target.tmp"
+    $probeBackup = Join-Path $outputDirectory ".$([System.IO.Path]::GetFileName($resolvedOutputPath)).$probeId.backup.tmp"
+    try {
+      $encoding = [System.Text.UTF8Encoding]::new($false)
+      [System.IO.File]::WriteAllText($probeSource, "probe-source", $encoding)
+      [System.IO.File]::WriteAllText($probeTarget, "probe-target", $encoding)
+      [System.IO.File]::Replace($probeSource, $probeTarget, $probeBackup)
+      [System.IO.File]::Delete($probeTarget)
+      [System.IO.File]::Delete($probeBackup)
+    } finally {
+      foreach ($probePath in @($probeSource, $probeTarget, $probeBackup)) {
+        if ($probePath -and [System.IO.File]::Exists($probePath)) {
+          [System.IO.File]::Delete($probePath)
+        }
+      }
+    }
+  } catch {
+    throw "Fresh public provenance output preflight failed before runtime mutation: $($_.Exception.Message)"
+  }
+
+  return $resolvedOutputPath
+}
+
+function Write-Utf8TextAtomically {
+  param(
+    [string]$OutputPath,
+    [string]$Value
+  )
+
+  $outputDirectory = Split-Path -Parent $OutputPath
+  $temporaryPath = Join-Path $outputDirectory ".$([System.IO.Path]::GetFileName($OutputPath)).$([Guid]::NewGuid().ToString('N')).tmp"
+  $backupPath = Join-Path $outputDirectory ".$([System.IO.Path]::GetFileName($OutputPath)).$([Guid]::NewGuid().ToString('N')).backup.tmp"
+  $published = $false
+  try {
+    $encoding = [System.Text.UTF8Encoding]::new($false)
+    $bytes = $encoding.GetBytes($Value)
+    $stream = [System.IO.FileStream]::new(
+      $temporaryPath,
+      [System.IO.FileMode]::CreateNew,
+      [System.IO.FileAccess]::Write,
+      [System.IO.FileShare]::None
+    )
+    try {
+      $stream.Write($bytes, 0, $bytes.Length)
+      $stream.Flush($true)
+    } finally {
+      $stream.Dispose()
+    }
+
+    if ([System.IO.File]::Exists($OutputPath)) {
+      [System.IO.File]::Replace($temporaryPath, $OutputPath, $backupPath)
+    } elseif (Test-Path -LiteralPath $OutputPath) {
+      throw "Fresh public provenance output became a non-file before commit: $OutputPath"
+    } else {
+      [System.IO.File]::Move($temporaryPath, $OutputPath)
+    }
+    $published = $true
+  } finally {
+    if ([System.IO.File]::Exists($temporaryPath)) {
+      [System.IO.File]::Delete($temporaryPath)
+    }
+    if ([System.IO.File]::Exists($backupPath)) {
+      try {
+        [System.IO.File]::Delete($backupPath)
+      } catch {
+        if ($published) {
+          Write-Warning "Atomic provenance receipt was published, but its temporary backup could not be removed: $backupPath"
+        } else {
+          throw
+        }
+      }
+    }
+  }
+}
+
+function Assert-FreshPublicProvenanceContract {
+  param(
+    [string]$SourceRoot,
+    [string]$SourceCommit,
+    [string]$SourceTree,
+    [string]$PythonPath,
+    [string]$PythonSha256,
+    [string]$CloudflaredPath,
+    [string]$CloudflaredSha256,
+    [string]$ConfigPath,
+    [string]$ConfigSha256
+  )
+
+  if (-not $ForceApiRestart) {
+    throw "-RequireFreshPublicProvenance requires -ForceApiRestart"
+  }
+  if ($SkipCloudflaredRestart) {
+    throw "-RequireFreshPublicProvenance forbids -SkipCloudflaredRestart"
+  }
+  foreach ($sourcePin in @($SourceCommit, $SourceTree)) {
+    if ($sourcePin -notmatch "^[0-9a-fA-F]{40}$") {
+      throw "Fresh public provenance requires exact source commit and tree pins"
+    }
+  }
+  foreach ($shaPin in @($PythonSha256, $CloudflaredSha256, $ConfigSha256)) {
+    if ($shaPin -notmatch "^[0-9a-fA-F]{64}$") {
+      throw "Fresh public provenance requires exact Python, cloudflared, and config SHA256 pins"
+    }
+  }
+
+  $resolvedSourceRoot = (Resolve-Path -LiteralPath $SourceRoot).Path
+  $expectedStartScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
+  $runningStartScript = (Resolve-Path -LiteralPath $PSCommandPath).Path
+  if (-not [string]::Equals(
+      $runningStartScript,
+      (Resolve-Path -LiteralPath $expectedStartScript).Path,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Fresh public promotion must execute the launcher from the pinned stable source root"
+  }
+
+  $gitRoot = Invoke-StableGitText -SourceRoot $resolvedSourceRoot -Arguments @("rev-parse", "--show-toplevel")
+  $resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+  if (-not [string]::Equals(
+      $resolvedGitRoot,
+      $resolvedSourceRoot,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Fresh public promotion source root does not match its Git toplevel"
+  }
+
+  $symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+  $symbolicHeadExit = $LASTEXITCODE
+  if ($symbolicHeadExit -eq 0) {
+    throw "Fresh public promotion requires detached HEAD, not branch $symbolicHead"
+  }
+  if ($symbolicHeadExit -ne 1) {
+    throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+  }
+
+  $actualCommit = Invoke-StableGitText -SourceRoot $resolvedSourceRoot -Arguments @("rev-parse", "--verify", "HEAD")
+  $actualTree = Invoke-StableGitText -SourceRoot $resolvedSourceRoot -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+  if ($actualCommit -ne $SourceCommit.ToLowerInvariant()) {
+    throw "Fresh public source commit drift: expected=$SourceCommit actual=$actualCommit"
+  }
+  if ($actualTree -ne $SourceTree.ToLowerInvariant()) {
+    throw "Fresh public source tree drift: expected=$SourceTree actual=$actualTree"
+  }
+  $dirty = Invoke-StableGitText -SourceRoot $resolvedSourceRoot -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+  if ($dirty) {
+    throw "Fresh public promotion requires a clean stable source"
+  }
+
+  foreach ($pin in @(
+    [pscustomobject]@{ Path = $PythonPath; Sha256 = $PythonSha256; Label = "Python" },
+    [pscustomobject]@{ Path = $CloudflaredPath; Sha256 = $CloudflaredSha256; Label = "cloudflared" },
+    [pscustomobject]@{ Path = $ConfigPath; Sha256 = $ConfigSha256; Label = "cloudflared config" }
+  )) {
+    if (-not (Test-Path -LiteralPath $pin.Path -PathType Leaf)) {
+      throw "Pinned $($pin.Label) file not found at $($pin.Path)"
+    }
+    $actualSha256 = (Get-FileHash -LiteralPath $pin.Path -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualSha256 -ne $pin.Sha256.ToLowerInvariant()) {
+      throw "Pinned $($pin.Label) SHA256 drift"
+    }
+  }
+}
+
 function Set-CloudflaredIngress {
   param(
     [string]$ConfigPath,
     [string[]]$ApiHostnames,
     [string[]]$WebHostnames,
     [int]$ApiPortValue,
-    [int]$WebPortValue
+    [int]$WebPortValue,
+    [switch]$RequireUnchanged
   )
 
   $lines = Get-Content -Encoding UTF8 -Path $ConfigPath
@@ -196,7 +640,21 @@ function Set-CloudflaredIngress {
   }
   $nextLines += "  - service: http_status:404"
 
-  Set-Content -Encoding UTF8 -Path $ConfigPath -Value $nextLines
+  $matches = $lines.Count -eq $nextLines.Count
+  if ($matches) {
+    for ($i = 0; $i -lt $lines.Count; $i++) {
+      if ($lines[$i] -cne $nextLines[$i]) {
+        $matches = $false
+        break
+      }
+    }
+  }
+  if ($RequireUnchanged -and -not $matches) {
+    throw "Pinned cloudflared config ingress does not match the requested public topology"
+  }
+  if (-not $matches) {
+    Set-Content -Encoding UTF8 -Path $ConfigPath -Value $nextLines
+  }
 }
 
 if (!(Test-Path $Python)) {
@@ -208,6 +666,46 @@ if (!(Test-Path $ApiDir)) {
 if (!(Test-Path $WebDir)) {
   throw "Web directory not found at $WebDir"
 }
+foreach ($voiceScript in @($WhisperStartScript, $MeloTtsStartScript, $VoiceSidecarProbe)) {
+  if (!(Test-Path -LiteralPath $voiceScript)) {
+    throw "Voice sidecar prerequisite not found at $voiceScript"
+  }
+}
+if ($RequireFreshPublicProvenance) {
+  if (!(Test-Path -LiteralPath $Cloudflared -PathType Leaf)) {
+    throw "cloudflared not found at $Cloudflared"
+  }
+  if (!(Test-Path -LiteralPath $CloudflaredConfig -PathType Leaf)) {
+    throw "cloudflared config not found at $CloudflaredConfig"
+  }
+  if (-not $RuntimeProvenancePath) {
+    $RuntimeProvenancePath = Join-Path $Workspace "public-runtime-launch-provenance.log"
+  }
+
+  Assert-FreshPublicProvenanceContract `
+    -SourceRoot $Workspace `
+    -SourceCommit $ExpectedSourceCommit `
+    -SourceTree $ExpectedSourceTree `
+    -PythonPath $Python `
+    -PythonSha256 $ExpectedPythonSha256 `
+    -CloudflaredPath $Cloudflared `
+    -CloudflaredSha256 $ExpectedCloudflaredSha256 `
+    -ConfigPath $CloudflaredConfig `
+    -ConfigSha256 $ExpectedCloudflaredConfigSha256
+
+  $resolvedRuntimeProvenancePath = Initialize-RuntimeProvenanceOutput `
+    -OutputPath $RuntimeProvenancePath
+
+  # 승격 모드에서 config를 재작성하면 사전 pin과 실제 tunnel 입력이 달라진다.
+  # exact ingress가 이미 들어 있는 경우에만 이후 프로세스 mutation으로 진행한다.
+  Set-CloudflaredIngress `
+    -ConfigPath $CloudflaredConfig `
+    -ApiHostnames $PublicApiHostnames `
+    -WebHostnames $PublicWebHostnames `
+    -ApiPortValue $ApiPort `
+    -WebPortValue $WebPort `
+    -RequireUnchanged
+}
 
 # 재기동 판정은 /health(프로세스 liveness)가 아니라 /ready(실제 claude -p 생성)로 한다.
 # 프로세스는 살아 있는데 그 프로세스의 claude 세션만 죽은 상태는 /health를 통과하므로,
@@ -222,7 +720,12 @@ if ($SkipEngineRestart) {
     throw "Engine gateway is not ready on http://127.0.0.1:$EnginePort/ready"
   }
 } elseif (-not $engineReady) {
-  Stop-UvicornByPort -AppImport "engine_gateway.gateway:app" -Port $EnginePort
+  $null = @(
+    Stop-UvicornByPort `
+      -AppImport "engine_gateway.gateway:app" `
+      -Port $EnginePort `
+      -TimeoutSec $ProcessStopTimeoutSeconds
+  )
 
   # Start-Process는 리다이렉트 대상 로그를 덮어쓴다. 직전 사고 로그를 보존해야
   # 재기동 후에도 원인을 추적할 수 있다.
@@ -255,6 +758,12 @@ $env:AUTH_DEV_LOGIN_ENABLED = "false"
 $env:AUTO_SEED_PERSONAS = "false"
 $env:ALLOW_SEED_PERSONA_FALLBACK = "false"
 $env:VIGNETTE_VOICE_POC_SAMPLE_TTS = "false"
+$env:VIGNETTE_VOICE_STT_PROVIDER = "local_whisper"
+$env:VIGNETTE_LOCAL_WHISPER_STT_URL = "ws://127.0.0.1:$WhisperPort/v1/listen"
+$env:VIGNETTE_LOCAL_WHISPER_STT_MODEL = $WhisperModel
+$env:VIGNETTE_LOCAL_WHISPER_STT_LANGUAGE = $WhisperLanguage
+$env:VIGNETTE_VOICE_TTS_PROVIDER = "melotts"
+$env:VIGNETTE_MELOTTS_TTS_URL = "http://127.0.0.1:$MeloTtsPort"
 $env:FRONTEND_BASE_URL = "https://vignette.chanpaca.net"
 $frontendOrigins = @("https://vignette.chanpaca.net", "https://vnet.18ka.net", "https://vignette-b1q.pages.dev")
 $localViteOrigins = @()
@@ -268,30 +777,117 @@ $env:FRONTEND_ORIGIN_MAP = ConvertTo-CompactJson -Value ([ordered]@{
   "api-vnet.18ka.net" = "https://vnet.18ka.net"
 })
 
+# 포트 리스너만으로는 올바른 provider/model을 증명하지 못한다. 첫 WS ready
+# 프레임과 MeloTTS health metadata가 운영 계약과 정확히 일치할 때만 API를
+# 유지하거나 재시작한다. 잘못된 기존 리스너는 소유권을 추측해 종료하지 않는다.
+if (-not (Test-VoiceSidecarReady -Component "stt")) {
+  if (Test-PortListener -Port $WhisperPort) {
+    throw "Port $WhisperPort is occupied but does not expose the exact local_whisper/$WhisperModel/$WhisperDevice protocol"
+  }
+  & $WhisperStartScript `
+    -Port $WhisperPort `
+    -Model $WhisperModel `
+    -Device $WhisperDevice `
+    -WaitReadySeconds 0
+  if (-not (Wait-VoiceSidecarReady -Component "stt" -TimeoutSec $VoiceSidecarReadySeconds)) {
+    throw "local_whisper/$WhisperModel/$WhisperDevice did not become exactly ready before the API restart gate"
+  }
+}
+
+if (-not (Test-VoiceSidecarReady -Component "tts")) {
+  if (Test-PortListener -Port $MeloTtsPort) {
+    throw "Port $MeloTtsPort is occupied but does not expose the exact melotts/$MeloTtsModel health contract"
+  }
+  & $MeloTtsStartScript `
+    -Port $MeloTtsPort `
+    -Language $MeloTtsLanguage `
+    -Device "cpu" `
+    -WaitReadySeconds 0
+  if (-not (Wait-VoiceSidecarReady -Component "tts" -TimeoutSec $VoiceSidecarReadySeconds)) {
+    throw "melotts/$MeloTtsModel did not become exactly ready before the API restart gate"
+  }
+}
+
+# 두 sidecar를 한 번 더 함께 검사해 개별 probe 사이의 TOCTOU를 닫는다.
+if (-not (Test-VoiceSidecarReady -Component "stt") -or -not (Test-VoiceSidecarReady -Component "tts")) {
+  throw "Voice sidecar readiness changed before the API restart gate"
+}
+
 $health = Get-JsonHealth -Uri "http://127.0.0.1:$ApiPort/health"
-$apiControlPlaneReady = $null -ne $health -and $health.environment -eq "prod" -and $health.db
+$voiceHealth = Get-JsonHealth -Uri "http://127.0.0.1:$ApiPort/voice/health"
+$apiControlPlaneReady = (
+  $null -ne $health -and
+  $health.environment -eq "prod" -and
+  $health.db -eq $true -and
+  $health.engine -eq $true -and
+  (Test-VoiceApiReady -Health $voiceHealth)
+)
 $proc = $null
+$apiStoppedProcessIds = @()
+$apiLaunchIdentity = $null
 if ($apiControlPlaneReady -and -not $ForceApiRestart) {
-  Write-Output "Admin/auth control plane already healthy; skipping API restart"
+  Write-Output "Production API and exact local voice stack already healthy; skipping API restart"
 } else {
-  Stop-UvicornByPort -AppImport "app.main:app" -Port $ApiPort
+  $apiStoppedProcessIds = @(
+    Stop-UvicornByPort `
+      -AppImport "app.main:app" `
+      -Port $ApiPort `
+      -TimeoutSec $ProcessStopTimeoutSeconds
+  )
 
   $proc = Start-Process -WindowStyle Hidden -FilePath $Python `
-    -ArgumentList @("-m", "uvicorn", "app.main:app", "--host", "127.0.0.1", "--port", "$ApiPort") `
+    -ArgumentList @(
+      "-m", "uvicorn", "app.main:app",
+      "--host", "127.0.0.1",
+      "--port", "$ApiPort",
+      "--ws", "websockets",
+      "--ws-max-queue", "4"
+    ) `
     -WorkingDirectory $ApiDir `
     -RedirectStandardOutput $OutLog `
     -RedirectStandardError $ErrLog `
     -PassThru
 
+  if ($RequireFreshPublicProvenance) {
+    if ($apiStoppedProcessIds -contains $proc.Id) {
+      throw "Fresh public API did not receive a replacement PID"
+    }
+    $apiLaunchIdentity = Wait-ProcessIdentity `
+      -ProcessId $proc.Id `
+      -Role "api" `
+      -ExpectedCwd $ApiDir `
+      -TimeoutSec $ProcessStopTimeoutSeconds
+    if ($apiLaunchIdentity.executable_sha256 -ne $ExpectedPythonSha256.ToLowerInvariant()) {
+      throw "Fresh public API executable SHA256 does not match the pinned Python"
+    }
+    foreach ($requiredArgument in @("uvicorn", "app.main:app", "--port", "$ApiPort", "--ws-max-queue", "4")) {
+      if ($apiLaunchIdentity.command_line.IndexOf($requiredArgument, [System.StringComparison]::Ordinal) -lt 0) {
+        throw "Fresh public API command line is missing required argument: $requiredArgument"
+      }
+    }
+  }
+
   Start-Sleep -Seconds 3
   $health = Wait-JsonHealth `
     -Uri "http://127.0.0.1:$ApiPort/health" `
-    -IsHealthy { param($health) $health.environment -eq "prod" -and $health.db } `
+    -IsHealthy {
+      param($health)
+      $health.environment -eq "prod" -and
+      $health.db -eq $true -and
+      $health.engine -eq $true
+    } `
+    -TimeoutSec 30
+  $voiceHealth = Wait-JsonHealth `
+    -Uri "http://127.0.0.1:$ApiPort/voice/health" `
+    -IsHealthy { param($health) Test-VoiceApiReady -Health $health } `
     -TimeoutSec 30
 }
-if ($health.environment -ne "prod" -or -not $health.db) {
+if ($health.environment -ne "prod" -or -not $health.db -or -not $health.engine) {
   throw "Admin/auth control plane is not production-safe: $($health | ConvertTo-Json -Compress)"
 }
+if (-not (Test-VoiceApiReady -Health $voiceHealth)) {
+  throw "Public voice API does not match the exact local provider/model contract: $($voiceHealth | ConvertTo-Json -Compress)"
+}
 
 if (!$SkipWebRestart) {
   Stop-NodeByPortHint -Port $WebPort
@@ -316,6 +912,9 @@ if (!$SkipWebRestart) {
   Wait-HttpStatus -Uri "http://127.0.0.1:$WebPort/" -TimeoutSec 30 | Out-Null
 }
 
+$cloudflaredProcess = $null
+$cloudflaredLaunchIdentity = $null
+$cloudflaredStoppedProcessIds = @()
 if (!$SkipCloudflaredRestart) {
   if (!(Test-Path $Cloudflared)) {
     throw "cloudflared not found at $Cloudflared"
@@ -324,11 +923,8 @@ if (!$SkipCloudflaredRestart) {
     throw "cloudflared config not found at $CloudflaredConfig"
   }
 
-  $apiHostnames = @("api-vignette.chanpaca.net", "api-vnet.18ka.net")
-  $webHostnames = @("vnet.18ka.net")
-
   if ($RouteCloudflareDns) {
-    foreach ($hostname in ($webHostnames + $apiHostnames)) {
+    foreach ($hostname in ($PublicWebHostnames + $PublicApiHostnames)) {
       & $Cloudflared tunnel route dns $CloudflareTunnelName $hostname
       if ($LASTEXITCODE -ne 0) {
         Write-Warning "cloudflared DNS route failed for $hostname"
@@ -336,25 +932,152 @@ if (!$SkipCloudflaredRestart) {
     }
   }
 
-  Set-CloudflaredIngress `
-    -ConfigPath $CloudflaredConfig `
-    -ApiHostnames $apiHostnames `
-    -WebHostnames $webHostnames `
-    -ApiPortValue $ApiPort `
-    -WebPortValue $WebPort
-
-  $cloudflaredProcess = Get-CimInstance Win32_Process |
-    Where-Object { $_.Name -eq "cloudflared.exe" -and $_.CommandLine -like "*vignette-config.yml*" } |
-    Select-Object -First 1
-  if ($null -eq $cloudflaredProcess) {
-    Start-Process -WindowStyle Hidden -FilePath $Cloudflared `
-      -ArgumentList @("tunnel", "--config", $CloudflaredConfig, "run") `
-      -RedirectStandardOutput (Join-Path $Workspace "cloudflared.public.out.log") `
-      -RedirectStandardError (Join-Path $Workspace "cloudflared.public.err.log") `
-      -PassThru | Out-Null
-  } else {
-    Write-Output "Cloudflared already running; skipping tunnel restart"
+  if (-not $RequireFreshPublicProvenance) {
+    Set-CloudflaredIngress `
+      -ConfigPath $CloudflaredConfig `
+      -ApiHostnames $PublicApiHostnames `
+      -WebHostnames $PublicWebHostnames `
+      -ApiPortValue $ApiPort `
+      -WebPortValue $WebPort
   }
+
+  $resolvedCloudflaredConfig = (Resolve-Path -LiteralPath $CloudflaredConfig).Path
+  if ($RequireFreshPublicProvenance) {
+    $existingCloudflaredProcesses = @(
+      Get-CloudflaredProcessesForConfig `
+        -ConfigPath $resolvedCloudflaredConfig `
+        -ExactPath
+    )
+  } else {
+    $existingCloudflaredProcesses = @(
+      Get-CloudflaredProcessesForConfig -ConfigPath $resolvedCloudflaredConfig
+    )
+  }
+  $cloudflaredStoppedProcessIds = @(
+    Stop-ProcessesBounded `
+      -Processes $existingCloudflaredProcesses `
+      -TimeoutSec $ProcessStopTimeoutSeconds `
+      -Role "cloudflared for $resolvedCloudflaredConfig"
+  )
+
+  $cloudflaredProcess = Start-Process -WindowStyle Hidden -FilePath $Cloudflared `
+    -ArgumentList @("tunnel", "--config", $resolvedCloudflaredConfig, "run") `
+    -WorkingDirectory $Workspace `
+    -RedirectStandardOutput (Join-Path $Workspace "cloudflared.public.out.log") `
+    -RedirectStandardError (Join-Path $Workspace "cloudflared.public.err.log") `
+    -PassThru
+
+  if ($cloudflaredStoppedProcessIds -contains $cloudflaredProcess.Id) {
+    throw "Cloudflared did not receive a replacement PID"
+  }
+  if ($RequireFreshPublicProvenance) {
+    $cloudflaredLaunchIdentity = Wait-ProcessIdentity `
+      -ProcessId $cloudflaredProcess.Id `
+      -Role "cloudflared" `
+      -ExpectedCwd $Workspace `
+      -TimeoutSec $ProcessStopTimeoutSeconds
+    if ($cloudflaredLaunchIdentity.executable_sha256 -ne $ExpectedCloudflaredSha256.ToLowerInvariant()) {
+      throw "Fresh cloudflared executable SHA256 does not match its pin"
+    }
+    if ($cloudflaredLaunchIdentity.command_line.IndexOf($resolvedCloudflaredConfig, [System.StringComparison]::OrdinalIgnoreCase) -lt 0) {
+      throw "Fresh cloudflared command line is not pinned to the expected config"
+    }
+  }
+}
+
+if ($RequireFreshPublicProvenance) {
+  if ($null -eq $apiLaunchIdentity -or $null -eq $cloudflaredLaunchIdentity) {
+    throw "Fresh public promotion did not produce both API and cloudflared identities"
+  }
+
+  $apiFinalIdentity = Wait-ProcessIdentity `
+    -ProcessId $apiLaunchIdentity.pid `
+    -Role "api" `
+    -ExpectedCwd $ApiDir `
+    -TimeoutSec $ProcessStopTimeoutSeconds
+  $cloudflaredFinalIdentity = Wait-ProcessIdentity `
+    -ProcessId $cloudflaredLaunchIdentity.pid `
+    -Role "cloudflared" `
+    -ExpectedCwd $Workspace `
+    -TimeoutSec $ProcessStopTimeoutSeconds
+  foreach ($identityPair in @(
+    [pscustomobject]@{ Role = "api"; Launch = $apiLaunchIdentity; Final = $apiFinalIdentity },
+    [pscustomobject]@{ Role = "cloudflared"; Launch = $cloudflaredLaunchIdentity; Final = $cloudflaredFinalIdentity }
+  )) {
+    foreach ($field in @("pid", "started_at_utc", "executable_sha256", "command_line_sha256", "cwd")) {
+      if ($identityPair.Launch[$field].ToString() -cne $identityPair.Final[$field].ToString()) {
+        throw "Fresh $($identityPair.Role) provenance drifted before receipt: $field"
+      }
+    }
+  }
+
+  $finalConfigSha256 = (Get-FileHash -LiteralPath $CloudflaredConfig -Algorithm SHA256).Hash.ToLowerInvariant()
+  if ($finalConfigSha256 -ne $ExpectedCloudflaredConfigSha256.ToLowerInvariant()) {
+    throw "Pinned cloudflared config drifted before provenance receipt"
+  }
+  $psutilVersionArgs = @("-X", "utf8", "-c", "import importlib.metadata; print(importlib.metadata.version('psutil'))")
+  $psutilVersion = (@(& $Python @psutilVersionArgs) -join [Environment]::NewLine).Trim()
+  if ($LASTEXITCODE -ne 0 -or -not $psutilVersion) {
+    throw "Could not record the psutil version used for process provenance"
+  }
+  $safeApiIdentity = ConvertTo-SafeProcessIdentity -Identity $apiFinalIdentity
+  $safeCloudflaredIdentity = ConvertTo-SafeProcessIdentity -Identity $cloudflaredFinalIdentity
+
+  $provenance = [ordered]@{
+    schema_version = "vignette.public-runtime-launch-provenance.v1"
+    status = "passed"
+    captured_at_utc = (Get-Date).ToUniversalTime().ToString("o")
+    source = [ordered]@{
+      repo_root = (Resolve-Path -LiteralPath $Workspace).Path
+      git_commit = $ExpectedSourceCommit.ToLowerInvariant()
+      git_tree = $ExpectedSourceTree.ToLowerInvariant()
+      launcher_sha256 = (Get-FileHash -LiteralPath $PSCommandPath -Algorithm SHA256).Hash.ToLowerInvariant()
+      clean_detached_head = $true
+    }
+    config = [ordered]@{
+      path = (Resolve-Path -LiteralPath $CloudflaredConfig).Path
+      sha256 = $finalConfigSha256
+    }
+    replacement = [ordered]@{
+      api_stopped_pids = @($apiStoppedProcessIds)
+      cloudflared_stopped_pids = @($cloudflaredStoppedProcessIds)
+      api_new_pid = [int]$apiFinalIdentity.pid
+      cloudflared_new_pid = [int]$cloudflaredFinalIdentity.pid
+    }
+    processes = [ordered]@{
+      api = $safeApiIdentity
+      cloudflared = $safeCloudflaredIdentity
+    }
+    topology_inputs = [ordered]@{
+      repo_root = (Resolve-Path -LiteralPath $Workspace).Path
+      git_sha = $ExpectedSourceCommit.ToLowerInvariant()
+      api_pid = [int]$apiFinalIdentity.pid
+      api_started_at_utc = $apiFinalIdentity.started_at_utc
+      api_executable_name = $apiFinalIdentity.executable_name
+      api_executable_sha256 = $apiFinalIdentity.executable_sha256
+      api_command_line_sha256 = $apiFinalIdentity.command_line_sha256
+      api_cwd = $apiFinalIdentity.cwd
+      api_listen_port = $ApiPort
+      cloudflared_pid = [int]$cloudflaredFinalIdentity.pid
+      cloudflared_started_at_utc = $cloudflaredFinalIdentity.started_at_utc
+      cloudflared_executable_name = $cloudflaredFinalIdentity.executable_name
+      cloudflared_executable_sha256 = $cloudflaredFinalIdentity.executable_sha256
+      cloudflared_command_line_sha256 = $cloudflaredFinalIdentity.command_line_sha256
+      cloudflared_cwd = $cloudflaredFinalIdentity.cwd
+      psutil_version = $psutilVersion
+    }
+  }
+  $provenanceJson = ConvertTo-Json -InputObject $provenance -Depth 8
+  try {
+    Write-Utf8TextAtomically `
+      -OutputPath $resolvedRuntimeProvenancePath `
+      -Value ($provenanceJson + [Environment]::NewLine)
+  } catch {
+    # 새 PID들은 이미 health/identity gate를 통과했지만, atomic receipt가 없으면
+    # 승격 성공으로 간주할 수 없다. 기존 receipt는 보존되고 호출은 non-zero로 끝난다.
+    throw "Fresh public promotion failed closed after runtime replacement: no atomic passed receipt was published. Re-run the pinned promotion after fixing the receipt destination. $($_.Exception.Message)"
+  }
+  Write-Output "Fresh public provenance: $resolvedRuntimeProvenancePath"
 }
 
 if ($engineReady) {
@@ -371,3 +1094,4 @@ if (!$SkipWebRestart) {
   Write-Output "Public vnet web preview running on http://127.0.0.1:$WebPort"
 }
 Write-Output "Health: $($health | ConvertTo-Json -Compress)"
+Write-Output "Voice health: $($voiceHealth | ConvertTo-Json -Compress)"
diff --git a/scripts/test_g7_external_proof.py b/scripts/test_g7_external_proof.py
index 93d4902..157719b 100644
--- a/scripts/test_g7_external_proof.py
+++ b/scripts/test_g7_external_proof.py
@@ -265,6 +265,153 @@ def topology() -> dict[str, object]:
     }
 
 
+def windows_topology() -> dict[str, object]:
+    process_metrics = {
+        "api": {
+            "rss_bytes": 200_000,
+            "peak_rss_bytes": 240_000,
+            "cpu_time_seconds": 2.0,
+            "cpu_percent": 3.0,
+            "handles": 40,
+            "threads": 8,
+        },
+        "cloudflared": {
+            "rss_bytes": 100_000,
+            "peak_rss_bytes": 120_000,
+            "cpu_time_seconds": 1.0,
+            "cpu_percent": 1.5,
+            "handles": 20,
+            "threads": 4,
+        },
+    }
+    process_tcp = {
+        "api": {"connections": 2, "established": 1, "listeners": 1},
+        "cloudflared": {"connections": 4, "established": 4, "listeners": 0},
+    }
+    samples = [
+        {
+            "sequence": index + 1,
+            "observed_at_utc": "2026-08-07T00:30:00Z",
+            "processes": copy.deepcopy(process_metrics),
+            "process_tcp": copy.deepcopy(process_tcp),
+            "host_tcp": {"connections": 20},
+            "api_listener": {
+                "port": 8001,
+                "owned_listener_count": 1,
+                "conflicting_listener_count": 0,
+            },
+        }
+        for index in range(31)
+    ]
+    return {
+        "schema_version": "vignette.g7-topology-evidence.v1",
+        "topology_mode": "windows_host",
+        "status": "passed",
+        "started_at_utc": "2026-08-07T00:00:00Z",
+        "ended_at_utc": "2026-08-07T01:00:00Z",
+        "scope": {
+            "metadata_only": True,
+            "raw_command_output_retained": False,
+            "socket_endpoints_retained": False,
+            "request_payloads_retained": False,
+            "audio_retained": False,
+            "transcripts_retained": False,
+            "topology_boundary": "windows_host_api_and_cloudflared_processes",
+            "configured_listener_port_retained": True,
+            "cloudflare_edge": {
+                "internal_queue_measured": False,
+                "evidence_boundary": "separate_external_artifact_required",
+            },
+        },
+        "requested": {
+            "public_host": "api.example.test",
+            "repo_root": r"D:\workspace\vignette",
+            "git_sha": "5" * 40,
+            "source_pin": {
+                "git_tree_sha": "8" * 40,
+                "script_sha256": {
+                    "runner": "9" * 64,
+                    "collector": "a" * 64,
+                    "checker": "b" * 64,
+                },
+                "runtime_dependencies": {"psutil": "6.1.1"},
+            },
+            "samples": 31,
+            "interval_seconds": 100.0,
+            "api_listen_port": 8001,
+            "roles": {
+                "api": {
+                    "pid": 301,
+                    "expected_executable_name": "python.exe",
+                    "expected_executable_sha256": "3" * 64,
+                    "expected_cwd": r"D:\workspace\vignette\apps\api",
+                },
+                "cloudflared": {
+                    "pid": 302,
+                    "expected_executable_name": "cloudflared.exe",
+                    "expected_executable_sha256": "4" * 64,
+                    "expected_cwd": r"D:\workspace\vignette",
+                },
+            },
+        },
+        "source_provenance": {
+            "detached_head": True,
+            "tracked_clean": True,
+            "git_sha": "5" * 40,
+            "git_tree_sha": "8" * 40,
+            "script_sha256": {
+                "runner": "9" * 64,
+                "collector": "a" * 64,
+                "checker": "b" * 64,
+            },
+            "runtime_dependencies": {"psutil": "6.1.1"},
+        },
+        "samples_completed": 31,
+        "targets": {
+            "api": {
+                "role": "api",
+                "pid": 301,
+                "started_at": "2026-08-06T00:00:00Z",
+                "executable_name": "python.exe",
+                "executable_sha256": "3" * 64,
+                "command_line_sha256": "6" * 64,
+                "git_sha": "5" * 40,
+                "cwd": r"D:\workspace\vignette\apps\api",
+            },
+            "cloudflared": {
+                "role": "cloudflared",
+                "pid": 302,
+                "started_at": "2026-08-06T00:00:00Z",
+                "executable_name": "cloudflared.exe",
+                "executable_sha256": "4" * 64,
+                "command_line_sha256": "7" * 64,
+                "git_sha": "5" * 40,
+                "cwd": r"D:\workspace\vignette",
+            },
+        },
+        "samples": samples,
+        "summary": {
+            "processes": {
+                role: {
+                    **{f"{field}_max": value for field, value in metrics.items()},
+                    **{
+                        f"tcp_{field}_max": value
+                        for field, value in process_tcp[role].items()
+                    },
+                }
+                for role, metrics in process_metrics.items()
+            },
+            "api_listener": {
+                "port": 8001,
+                "owned_listener_count_min": 1,
+                "conflicting_listener_count_max": 0,
+            },
+            "host_tcp": {"connections_max": 20},
+        },
+        "failure_type": None,
+    }
+
+
 class G7ExternalProofTests(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
@@ -286,6 +433,97 @@ class G7ExternalProofTests(unittest.TestCase):
         self.assertTrue(gain["passed"])
         self.assertGreaterEqual(gain["held_out_participants"], 30)
 
+    def test_windows_host_topology_passes_without_weakening_compose(self) -> None:
+        errors: list[str] = []
+        payload = windows_topology()
+        compose_payload = topology()
+        compose_payload["topology_mode"] = "linux_compose"
+
+        self.checker.validate_topology(payload, errors)
+        self.checker.validate_topology(compose_payload, errors)
+        self.checker.validate_binding(public_soak(), runtime(), payload, errors)
+
+        self.assertEqual([], errors)
+
+    def test_windows_host_identity_listener_and_summary_fail_closed(self) -> None:
+        cases = (
+            (
+                lambda payload: payload["targets"]["api"].__setitem__("pid", 999),
+                "topology:api_pid_pin",
+            ),
+            (
+                lambda payload: payload["samples"][0]["api_listener"].__setitem__(
+                    "owned_listener_count", 0
+                ),
+                "topology:listener_owner_sample",
+            ),
+            (
+                lambda payload: payload["summary"]["processes"]["api"].__setitem__(
+                    "rss_bytes_max", 1
+                ),
+                "topology:api_rss_bytes_max",
+            ),
+        )
+        for mutate, failure in cases:
+            with self.subTest(failure=failure):
+                payload = windows_topology()
+                mutate(payload)
+                errors: list[str] = []
+                self.checker.validate_topology(payload, errors)
+                self.assertIn(failure, errors)
+
+    def test_windows_source_and_toolchain_provenance_fail_closed(self) -> None:
+        cases = (
+            (
+                lambda payload: payload["source_provenance"].__setitem__(
+                    "detached_head", False
+                ),
+                "topology:windows_detached_head",
+            ),
+            (
+                lambda payload: payload["source_provenance"].__setitem__(
+                    "tracked_clean", False
+                ),
+                "topology:windows_tracked_clean",
+            ),
+            (
+                lambda payload: payload["source_provenance"].__setitem__(
+                    "git_tree_sha", "c" * 40
+                ),
+                "topology:windows_source_git_tree_sha",
+            ),
+            (
+                lambda payload: payload["source_provenance"]["script_sha256"].__setitem__(
+                    "runner", "c" * 64
+                ),
+                "topology:windows_source_script_sha256",
+            ),
+            (
+                lambda payload: payload["source_provenance"][
+                    "runtime_dependencies"
+                ].__setitem__("psutil", "6.1.0"),
+                "topology:windows_source_psutil_version",
+            ),
+        )
+        for mutate, failure in cases:
+            with self.subTest(failure=failure):
+                payload = windows_topology()
+                mutate(payload)
+                errors: list[str] = []
+                self.checker.validate_topology(payload, errors)
+                self.assertIn(failure, errors)
+
+        unpinned_version = windows_topology()
+        unpinned_version["requested"]["source_pin"]["runtime_dependencies"][
+            "psutil"
+        ] = "6.1.0"
+        unpinned_version["source_provenance"]["runtime_dependencies"][
+            "psutil"
+        ] = "6.1.0"
+        errors = []
+        self.checker.validate_topology(unpinned_version, errors)
+        self.assertIn("topology:windows_psutil_version_pin", errors)
+
     def test_decided_local_stack_is_accepted(self) -> None:
         """2026-08-08 소유자 결정: 노트북 faster-whisper STT + MeloTTS TTS (둘 다 MIT)."""
 
@@ -353,6 +591,44 @@ class G7ExternalProofTests(unittest.TestCase):
         self.assertIn("voice_soak:physical_microphone_used", errors)
         self.assertIn("binding:no_concurrent_overlap", errors)
 
+    def test_concurrent_window_requires_full_3000_second_intersection(self) -> None:
+        exact_errors: list[str] = []
+        exact_voice = public_soak()
+        exact_voice["ended_at_utc"] = "2026-08-07T00:50:00Z"
+        exact_runtime = runtime()
+        exact_runtime["ended_at_utc"] = "2026-08-07T00:50:00Z"
+        exact_topology = topology()
+        exact_topology["ended_at_utc"] = "2026-08-07T00:50:00Z"
+
+        self.checker.validate_binding(
+            exact_voice,
+            exact_runtime,
+            exact_topology,
+            exact_errors,
+        )
+
+        self.assertEqual([], exact_errors)
+
+        short_errors: list[str] = []
+        short_voice = public_soak()
+        short_voice["ended_at_utc"] = "2026-08-07T00:50:00Z"
+        short_runtime = runtime()
+        short_runtime["started_at_utc"] = "2026-08-07T00:00:01Z"
+        short_runtime["ended_at_utc"] = "2026-08-07T00:50:00Z"
+        short_topology = topology()
+        short_topology["ended_at_utc"] = "2026-08-07T00:50:00Z"
+        self.checker.validate_binding(
+            short_voice,
+            short_runtime,
+            short_topology,
+            short_errors,
+        )
+
+        self.assertIn(
+            "binding:concurrent_overlap_below_3000_seconds",
+            short_errors,
+        )
+
     def test_runtime_fallback_and_short_topology_fail(self) -> None:
         errors: list[str] = []
         runtime_payload = runtime()
diff --git a/scripts/test_g7_topology_evidence.py b/scripts/test_g7_topology_evidence.py
index 8a23986..7a11fbb 100644
--- a/scripts/test_g7_topology_evidence.py
+++ b/scripts/test_g7_topology_evidence.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import importlib.util
+import hashlib
 import json
 import sys
 import unittest
@@ -11,6 +12,11 @@ from typing import Sequence
 
 
 RUNNER_PATH = Path(__file__).with_name("capture-g7-topology-evidence.py")
+REPO_ROOT = RUNNER_PATH.resolve().parents[1]
+
+
+def file_sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
 def load_runner():
@@ -27,6 +33,16 @@ API_ID = "a" * 64
 CADDY_ID = "c" * 64
 API_DIGEST = "sha256:" + "1" * 64
 CADDY_DIGEST = "sha256:" + "2" * 64
+API_EXE_DIGEST = "3" * 64
+CLOUDFLARED_EXE_DIGEST = "4" * 64
+GIT_SHA = "5" * 40
+GIT_TREE_SHA = "8" * 40
+PSUTIL_VERSION = "6.1.1"
+SCRIPT_DIGESTS = {
+    "runner": file_sha256(REPO_ROOT / "scripts/run-g7-external-proof-window.py"),
+    "collector": file_sha256(REPO_ROOT / "scripts/capture-g7-topology-evidence.py"),
+    "checker": file_sha256(REPO_ROOT / "scripts/check-g7-external-proof.py"),
+}
 
 
 def inspect_item(
@@ -114,9 +130,17 @@ class FixtureRunner:
         self,
         *,
         inspect_outputs: list[str] | None = None,
+        git_outputs: list[str] | None = None,
+        git_branch: str = "HEAD\n",
+        git_status: str = "",
+        git_tree_sha: str = GIT_TREE_SHA,
         unavailable: set[str] | None = None,
     ) -> None:
         self.inspect_outputs = list(inspect_outputs or [stable_inspect()])
+        self.git_outputs = list(git_outputs or [GIT_SHA + "\n"])
+        self.git_branch = git_branch
+        self.git_status = git_status
+        self.git_tree_sha = git_tree_sha
         self.unavailable = unavailable or set()
         self.calls: list[tuple[str, ...]] = []
 
@@ -134,6 +158,21 @@ class FixtureRunner:
             return stats_output()
         if command == ("ss", "-tinm"):
             return SS_OUTPUT
+        if command and command[0] == "git":
+            operation = command[3:]
+            if operation == ("rev-parse", "--abbrev-ref", "HEAD"):
+                return self.git_branch
+            if operation == (
+                "status",
+                "--porcelain=v1",
+                "--untracked-files=no",
+            ):
+                return self.git_status
+            if operation == ("rev-parse", "--verify", "HEAD^{tree}"):
+                return self.git_tree_sha + "\n"
+            if len(self.git_outputs) > 1:
+                return self.git_outputs.pop(0)
+            return self.git_outputs[0]
         raise AssertionError(f"unexpected command: {command!r}")
 
 
@@ -170,6 +209,106 @@ class FixtureSource:
         return list(self.directories[path])
 
 
+class FixtureWindowsSource:
+    def __init__(
+        self,
+        module,
+        *,
+        identity_overrides: dict[str, list[dict[str, object]]] | None = None,
+        tcp_overrides: dict[str, object] | None = None,
+        psutil_version: str = PSUTIL_VERSION,
+    ) -> None:
+        self.module = module
+        self.identity_overrides = identity_overrides or {}
+        self.tcp_overrides = tcp_overrides or {}
+        self.psutil_version = psutil_version
+        self.metric_calls = {"api": 0, "cloudflared": 0}
+
+    def dependency_version(self, name: str) -> str:
+        if name != "psutil":
+            raise AssertionError(f"unexpected dependency: {name}")
+        return self.psutil_version
+
+    def _base_identity(self, role: str, git_sha: str) -> dict[str, object]:
+        if role == "api":
+            return {
+                "role": role,
+                "pid": 301,
+                "started_at": "2026-08-07T00:00:00Z",
+                "executable_name": "python.exe",
+                "executable_sha256": API_EXE_DIGEST,
+                "command_line_sha256": "6" * 64,
+                "git_sha": git_sha,
+                "cwd": r"D:\workspace\vignette\apps\api",
+            }
+        return {
+            "role": role,
+            "pid": 302,
+            "started_at": "2026-08-07T00:00:00Z",
+            "executable_name": "cloudflared.exe",
+            "executable_sha256": CLOUDFLARED_EXE_DIGEST,
+            "command_line_sha256": "7" * 64,
+            "git_sha": git_sha,
+            "cwd": r"D:\workspace\vignette",
+        }
+
+    def read_identity(self, *, pid: int, role: str, git_sha: str):
+        values = self._base_identity(role, git_sha)
+        overrides = self.identity_overrides.get(role, [])
+        if overrides:
+            values.update(overrides[0])
+            if len(overrides) > 1:
+                overrides.pop(0)
+        self.assert_pid(role, pid)
+        return self.module.WindowsProcessIdentity(**values)
+
+    def assert_pid(self, role: str, pid: int) -> None:
+        expected = 301 if role == "api" else 302
+        if pid != expected:
+            raise AssertionError(f"unexpected {role} pid: {pid}")
+
+    def read_metrics(self, *, pid: int, role: str) -> dict[str, int | float]:
+        self.assert_pid(role, pid)
+        self.metric_calls[role] += 1
+        factor = 2 if role == "api" else 1
+        return {
+            "rss_bytes": 100_000 * factor,
+            "peak_rss_bytes": 120_000 * factor,
+            "cpu_time_seconds": float(self.metric_calls[role] * factor),
+            "cpu_percent": 1.5 * factor,
+            "handles": 20 * factor,
+            "threads": 4 * factor,
+        }
+
+    def read_tcp_metrics(
+        self,
+        *,
+        api_pid: int,
+        cloudflared_pid: int,
+        api_listen_port: int,
+    ) -> dict[str, object]:
+        self.assert_pid("api", api_pid)
+        self.assert_pid("cloudflared", cloudflared_pid)
+        payload: dict[str, object] = {
+            "processes": {
+                "api": {"connections": 2, "established": 1, "listeners": 1},
+                "cloudflared": {
+                    "connections": 4,
+                    "established": 4,
+                    "listeners": 0,
+                },
+            },
+            "host_tcp": {"connections": 20},
+            "api_listener": {
+                "port": api_listen_port,
+                "owned_listener_count": 1,
+                "conflicting_listener_count": 0,
+            },
+        }
+        payload.update(self.tcp_overrides)
+        return payload
+
+
 class G7TopologyEvidenceTests(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
@@ -191,6 +330,31 @@ class G7TopologyEvidenceTests(unittest.TestCase):
         values.update(overrides)
         return self.runner_module.CaptureConfig(**values)
 
+    def windows_config(self, **overrides):
+        values = {
+            "public_host": "api.example.test",
+            "repo_root": r"D:\workspace\vignette",
+            "git_sha": GIT_SHA,
+            "git_tree_sha": GIT_TREE_SHA,
+            "runner_script_sha256": SCRIPT_DIGESTS["runner"],
+            "collector_script_sha256": SCRIPT_DIGESTS["collector"],
+            "checker_script_sha256": SCRIPT_DIGESTS["checker"],
+            "psutil_version": PSUTIL_VERSION,
+            "api_pid": 301,
+            "api_executable_name": "python.exe",
+            "api_executable_sha256": API_EXE_DIGEST,
+            "api_cwd": r"D:\workspace\vignette\apps\api",
+            "api_listen_port": 8001,
+            "cloudflared_pid": 302,
+            "cloudflared_executable_name": "cloudflared.exe",
+            "cloudflared_executable_sha256": CLOUDFLARED_EXE_DIGEST,
+            "cloudflared_cwd": r"D:\workspace\vignette",
+            "samples": 2,
+            "interval_seconds": 1.0,
+        }
+        values.update(overrides)
+        return self.runner_module.WindowsHostConfig(**values)
+
     def test_parsers_emit_numeric_metadata_without_endpoints(self) -> None:
         source = FixtureSource()
         targets = self.runner_module.pin_targets(self.config(), FixtureRunner(), source)
@@ -231,6 +395,7 @@ class G7TopologyEvidenceTests(unittest.TestCase):
         )
 
         self.assertEqual("passed", evidence["status"])
+        self.assertEqual("linux_compose", evidence["topology_mode"])
         self.assertEqual(1, evidence["samples_completed"])
         self.assertEqual(API_ID, evidence["targets"]["api"]["container_id"])
         self.assertEqual(API_DIGEST, evidence["targets"]["api"]["image_digest"])
@@ -328,6 +493,201 @@ class G7TopologyEvidenceTests(unittest.TestCase):
                     self.runner_module.validate_config(config)
                 self.assertEqual(failure, str(caught.exception))
 
+    def test_windows_capture_pins_processes_listener_and_high_water(self) -> None:
+        source = FixtureWindowsSource(self.runner_module)
+        evidence = self.runner_module.capture_windows_evidence(
+            self.windows_config(),
+            FixtureRunner(),
+            source,
+            sleep=lambda _seconds: None,
+        )
+
+        self.assertEqual("passed", evidence["status"])
+        self.assertEqual("windows_host", evidence["topology_mode"])
+        self.assertEqual({"api", "cloudflared"}, set(evidence["targets"]))
+        self.assertEqual(
+            {
+                "detached_head": True,
+                "tracked_clean": True,
+                "git_sha": GIT_SHA,
+                "git_tree_sha": GIT_TREE_SHA,
+                "script_sha256": SCRIPT_DIGESTS,
+                "runtime_dependencies": {"psutil": PSUTIL_VERSION},
+            },
+            evidence["source_provenance"],
+        )
+        self.assertEqual(GIT_SHA, evidence["targets"]["api"]["git_sha"])
+        self.assertEqual(
+            API_EXE_DIGEST,
+            evidence["targets"]["api"]["executable_sha256"],
+        )
+        self.assertEqual(
+            r"D:\workspace\vignette\apps\api",
+            evidence["targets"]["api"]["cwd"],
+        )
+        summary = evidence["summary"]
+        self.assertEqual(4.0, summary["processes"]["api"]["cpu_time_seconds_max"])
+        self.assertEqual(1, summary["api_listener"]["owned_listener_count_min"])
+        self.assertEqual(4, summary["processes"]["cloudflared"]["tcp_established_max"])
+        serialized = json.dumps(evidence)
+        self.assertNotIn("127.0.0.1", serialized)
+
+    def test_windows_identity_and_git_drift_fail_closed(self) -> None:
+        cases = (
+            (
+                FixtureRunner(),
+                FixtureWindowsSource(
+                    self.runner_module,
+                    identity_overrides={
+                        "api": [{"started_at": "2999-01-01T00:00:00Z"}]
+                    },
+                ),
+                "process_started_at_future:api",
+            ),
+            (
+                FixtureRunner(),
+                FixtureWindowsSource(
+                    self.runner_module,
+                    identity_overrides={
+                        "api": [
+                            {},
+                            {"command_line_sha256": "8" * 64},
+                        ]
+                    },
+                ),
+                "process_command_line_drift:api",
+            ),
+            (
+                FixtureRunner(git_outputs=[GIT_SHA + "\n", "9" * 40 + "\n"]),
+                FixtureWindowsSource(self.runner_module),
+                "git_sha_drift",
+            ),
+        )
+        for runner, source, failure in cases:
+            with self.subTest(failure=failure):
+                with self.assertRaises(self.runner_module.EvidenceFailure) as caught:
+                    self.runner_module.capture_windows_evidence(
+                        self.windows_config(samples=1),
+                        runner,
+                        source,
+                        sleep=lambda _seconds: None,
+                    )
+                self.assertEqual(failure, str(caught.exception))
+
+    def test_windows_source_and_toolchain_provenance_fail_closed(self) -> None:
+        cases = (
+            (
+                FixtureRunner(git_branch="master\n"),
+                FixtureWindowsSource(self.runner_module),
+                self.windows_config(samples=1),
+                "git_head_not_detached",
+            ),
+            (
+                FixtureRunner(git_status=" M scripts/check-g7-external-proof.py\n"),
+                FixtureWindowsSource(self.runner_module),
+                self.windows_config(samples=1),
+                "git_tracked_worktree_dirty",
+            ),
+            (
+                FixtureRunner(git_tree_sha="9" * 40),
+                FixtureWindowsSource(self.runner_module),
+                self.windows_config(samples=1),
+                "git_tree_sha_drift",
+            ),
+            (
+                FixtureRunner(),
+                FixtureWindowsSource(self.runner_module),
+                self.windows_config(samples=1, checker_script_sha256="9" * 64),
+                "evidence_script_sha256_drift:checker",
+            ),
+            (
+                FixtureRunner(),
+                FixtureWindowsSource(self.runner_module, psutil_version="6.1.0"),
+                self.windows_config(samples=1),
+                "psutil_version_drift",
+            ),
+        )
+        for runner, source, config, failure in cases:
+            with self.subTest(failure=failure):
+                with self.assertRaises(self.runner_module.EvidenceFailure) as caught:
+                    self.runner_module.capture_windows_evidence(
+                        config,
+                        runner,
+                        source,
+                        sleep=lambda _seconds: None,
+                    )
+                self.assertEqual(failure, str(caught.exception))
+
+    def test_windows_listener_and_tunnel_connection_are_required(self) -> None:
+        cases = (
+            (
+                {
+                    "api_listener": {
+                        "port": 8001,
+                        "owned_listener_count": 0,
+                        "conflicting_listener_count": 0,
+                    }
+                },
+                "api_listener_not_owned",
+            ),
+            (
+                {
+                    "processes": {
+                        "api": {
+                            "connections": 2,
+                            "established": 1,
+                            "listeners": 1,
+                        },
+                        "cloudflared": {
+                            "connections": 0,
+                            "established": 0,
+                            "listeners": 0,
+                        },
+                    }
+                },
+                "cloudflared_tunnel_connection_missing",
+            ),
+        )
+        for overrides, failure in cases:
+            with self.subTest(failure=failure):
+                source = FixtureWindowsSource(
+                    self.runner_module,
+                    tcp_overrides=overrides,
+                )
+                with self.assertRaises(self.runner_module.EvidenceFailure) as caught:
+                    self.runner_module.capture_windows_evidence(
+                        self.windows_config(samples=1),
+                        FixtureRunner(),
+                        source,
+                        sleep=lambda _seconds: None,
+                    )
+                self.assertEqual(failure, str(caught.exception))
+
+    def test_windows_config_rejects_shared_pid_and_outside_cwd(self) -> None:
+        cases = (
+            (
+                self.windows_config(cloudflared_pid=301),
+                "process_targets_not_distinct",
+            ),
+            (
+                self.windows_config(api_cwd=r"C:\elsewhere"),
+                "api_cwd_outside_repo",
+            ),
+            (
+                self.windows_config(git_tree_sha="not-a-tree"),
+                "git_tree_sha_invalid",
+            ),
+            (
+                self.windows_config(psutil_version="6.1.0"),
+                "psutil_version_invalid",
+            ),
+        )
+        for config, failure in cases:
+            with self.subTest(failure=failure):
+                with self.assertRaises(self.runner_module.EvidenceFailure) as caught:
+                    self.runner_module.validate_windows_config(config)
+                self.assertEqual(failure, str(caught.exception))
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/scripts/test_local_whisper_stt_server.py b/scripts/test_local_whisper_stt_server.py
index d9e19f2..bd00833 100644
--- a/scripts/test_local_whisper_stt_server.py
+++ b/scripts/test_local_whisper_stt_server.py
@@ -54,7 +54,7 @@ class FakeTranscriber:
 
 def default_options(**overrides):
     options = {
-        "model": "large-v3",
+        "model": MODULE.DEFAULT_MODEL,
         "language": "ko",
         "sample_rate": SAMPLE_RATE,
         "channels": 1,
@@ -403,6 +403,10 @@ class CliTest(unittest.TestCase):
         with self.assertRaises(SystemExit):
             parser.parse_args(["--host", "0.0.0.0"])
 
+    def test_default_model_matches_the_cpu_public_runtime_contract(self) -> None:
+        parser = MODULE.build_parser()
+        self.assertEqual(parser.parse_args([]).model, "small")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/scripts/test_melotts_server.py b/scripts/test_melotts_server.py
index 5ac739c..6f636f6 100644
--- a/scripts/test_melotts_server.py
+++ b/scripts/test_melotts_server.py
@@ -106,6 +106,8 @@ class HealthPayloadTest(unittest.TestCase):
     def test_health_declares_the_permissive_license_and_no_reference(self) -> None:
         payload = MODULE.health_payload(FakeSynthesizer(), speakers=["KR"])
         self.assertEqual(payload["status"], "ok")
+        self.assertEqual(payload["provider"], "melotts")
+        self.assertEqual(payload["model"], "melotts-korean")
         self.assertEqual(payload["license"], "MIT")
         self.assertEqual(payload["language"], "KR")
         self.assertEqual(payload["sample_rate"], 44_100)
diff --git a/scripts/test_outcome_os_release_agent.py b/scripts/test_outcome_os_release_agent.py
index 2ade92d..48ce3cb 100644
--- a/scripts/test_outcome_os_release_agent.py
+++ b/scripts/test_outcome_os_release_agent.py
@@ -5,9 +5,9 @@ from __future__ import annotations
 import importlib.util
 import json
 import sys
+import tarfile
 import tempfile
 import unittest
-import tarfile
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
@@ -31,12 +31,25 @@ class FakeRunner:
     module: Any
     fail_stage: str | None = None
     builder_shas: tuple[str, str] = ("a" * 64, "a" * 64)
+    tracked_status: str = ""
+    clean_archive_payloads: tuple[bytes, bytes] = (b"clean archive", b"clean archive")
+    clean_head: str = "b" * 40
+    clean_tree: str = "c" * 40
     calls: list[str] = field(default_factory=list)
     commands: dict[str, list[str]] = field(default_factory=dict)
+    working_directories: dict[str, Path | None] = field(default_factory=dict)
+    environments: dict[str, dict[str, str] | None] = field(default_factory=dict)
+    timeouts: dict[str, int | None] = field(default_factory=dict)
+    event_log: list[str] | None = None
 
-    def run(self, stage: str, argv: list[str], **_: Any):
+    def run(self, stage: str, argv: list[str], **kwargs: Any):
         self.calls.append(stage)
         self.commands[stage] = list(argv)
+        self.working_directories[stage] = kwargs.get("cwd")
+        self.environments[stage] = kwargs.get("env")
+        self.timeouts[stage] = kwargs.get("timeout")
+        if self.event_log is not None:
+            self.event_log.append(f"runner:{stage}")
         if stage == self.fail_stage:
             raise self.module.StageFailure(stage, "synthetic failure")
         if stage.startswith("release_patch_run_"):
@@ -57,6 +70,19 @@ class FakeRunner:
             return self.module.CommandResult(0, json.dumps(payload), "")
         if stage == "release_manifest":
             return self.module.CommandResult(0, json.dumps({"ok": True}), "")
+        if stage == "clean_head_repository":
+            return self.module.CommandResult(0, str(kwargs["cwd"].resolve()) + "\n", "")
+        if stage.startswith("clean_head_worktree_"):
+            return self.module.CommandResult(0, self.tracked_status, "")
+        if stage.startswith("clean_head_head_"):
+            return self.module.CommandResult(0, self.clean_head + "\n", "")
+        if stage.startswith("clean_head_tree_"):
+            return self.module.CommandResult(0, self.clean_tree + "\n", "")
+        if stage.startswith("clean_head_archive_run_"):
+            run_index = int(stage.rsplit("_", 1)[1]) - 1
+            output_index = argv.index("--output")
+            Path(argv[output_index + 1]).write_bytes(self.clean_archive_payloads[run_index])
+            return self.module.CommandResult(0, "", "")
         return self.module.CommandResult(0, f"{stage}: passed", "")
 
 
@@ -67,9 +93,15 @@ class FakeDeployment:
     rollback_matches: bool = True
     tracked_api_image: str = "sha256:" + "1" * 64
     calls: list[str] = field(default_factory=list)
+    event_log: list[str] | None = None
+
+    def _record(self, event: str) -> None:
+        self.calls.append(event)
+        if self.event_log is not None:
+            self.event_log.append(f"deployment:{event}")
 
     def read_active_state(self):
-        self.calls.append("read_active_state")
+        self._record("read_active_state")
         if self.active_sha is None:
             return None
         return {
@@ -84,7 +116,7 @@ class FakeDeployment:
         }
 
     def snapshot(self):
-        self.calls.append("snapshot")
+        self._record("snapshot")
         return self.module.DeploymentSnapshot(
             api_image="sha256:" + "1" * 64,
             web_image="sha256:" + "2" * 64,
@@ -94,7 +126,7 @@ class FakeDeployment:
         )
 
     def promote(self, candidate: Path, desired_sha: str, snapshot: Any):
-        self.calls.append("promote")
+        self._record("promote")
         return {
             "active_sha": desired_sha,
             "api_image": "sha256:" + "3" * 64,
@@ -104,16 +136,16 @@ class FakeDeployment:
         }
 
     def commit_active_state(self, state: dict[str, Any]):
-        self.calls.append("commit_active_state")
+        self._record("commit_active_state")
         self.active_sha = state["active_sha"]
 
     def rollback(self, snapshot: Any):
-        self.calls.append("rollback")
+        self._record("rollback")
         self.active_sha = snapshot.active_sha
         return {"api_image": snapshot.api_image, "web_image": snapshot.web_image}
 
     def verify_rollback(self, snapshot: Any):
-        self.calls.append("verify_rollback")
+        self._record("verify_rollback")
         return {
             "ok": self.rollback_matches,
             "api_image": snapshot.api_image if self.rollback_matches else "sha256:" + "9" * 64,
@@ -164,9 +196,20 @@ class FakeCandidate:
     def __init__(self, root: Path):
         self.root = root
         self.cleaned = False
+        self.materialization_mode: str | None = None
+        self.archive_sha256: str | None = None
+        self.archive_bytes: bytes | None = None
 
     def materialize(self, base_commit: str, patch_path: str):
         del base_commit, patch_path
+        self.materialization_mode = "patch"
+        self.root.mkdir(parents=True, exist_ok=True)
+        return self.root
+
+    def materialize_archive(self, archive_path: Path, expected_sha256: str):
+        self.materialization_mode = "clean-head"
+        self.archive_sha256 = expected_sha256
+        self.archive_bytes = archive_path.read_bytes()
         self.root.mkdir(parents=True, exist_ok=True)
         return self.root
 
@@ -268,17 +311,38 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         execute: bool,
         fail_stage: str | None = None,
         builder_shas: tuple[str, str] = ("a" * 64, "a" * 64),
+        source_mode: str = "patch",
+        tracked_status: str = "",
+        clean_archive_payloads: tuple[bytes, bytes] = (
+            b"clean archive",
+            b"clean archive",
+        ),
+        source_repo_root: Path | None = None,
         runtime_fail_on_call: int | None = None,
         rollback_matches: bool = True,
     ):
-        runner = FakeRunner(self.agent_module, fail_stage, builder_shas)
-        deployment = FakeDeployment(self.agent_module, active_sha, rollback_matches)
+        event_log: list[str] = []
+        runner = FakeRunner(
+            module=self.agent_module,
+            fail_stage=fail_stage,
+            builder_shas=builder_shas,
+            tracked_status=tracked_status,
+            clean_archive_payloads=clean_archive_payloads,
+            event_log=event_log,
+        )
+        deployment = FakeDeployment(
+            self.agent_module,
+            active_sha,
+            rollback_matches,
+            event_log=event_log,
+        )
         runtime = FakeRuntimeProbe(self.agent_module, runtime_fail_on_call)
         candidate = FakeCandidate(self.root / "candidate")
         config = self.agent_module.ReleaseAgentConfig(
-            repo_root=self.root,
+            repo_root=source_repo_root or self.root,
             manifest_path=self.manifest_path,
             hunk_map_path=self.root / "docs/ops/hunk-map.json",
+            source_mode=source_mode,
             execute=execute,
             milestone=self.milestone,
             target=self.agent_module.NAS_PREVIEW_TARGET,
@@ -340,6 +404,157 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
             runner.calls,
         )
 
+    def test_parser_keeps_patch_and_controller_repo_defaults(self) -> None:
+        parser = self.agent_module.build_parser()
+        default_args = parser.parse_args(["--milestone", "milestone.json"])
+        detached_root = self.root / "detached"
+        clean_args = parser.parse_args(
+            [
+                "--milestone",
+                "milestone.json",
+                "--source-mode",
+                "clean-head",
+                "--source-repo-root",
+                str(detached_root),
+            ]
+        )
+
+        self.assertEqual("patch", default_args.source_mode)
+        self.assertEqual(self.agent_module.REPO_ROOT, default_args.source_repo_root)
+        self.assertEqual("clean-head", clean_args.source_mode)
+        self.assertEqual(detached_root, clean_args.source_repo_root)
+
+    def test_source_repo_root_must_be_an_absolute_existing_directory(self) -> None:
+        relative = Path("detached-source")
+        missing = self.root / "missing"
+        source_file = self.root / "source-file"
+        source_file.write_text("not a directory\n", encoding="utf-8")
+
+        for source_root, message in (
+            (relative, "must be absolute"),
+            (missing, "does not exist"),
+            (source_file, "not a directory"),
+        ):
+            with self.subTest(source_root=source_root):
+                with self.assertRaisesRegex(self.agent_module.StageFailure, message):
+                    self.agent_module.validate_source_repo_root(source_root)
+
+    def test_clean_head_override_runs_every_git_command_in_source_repo(self) -> None:
+        detached_root = self.root / "detached-source"
+        detached_root.mkdir()
+        archive_payload = b"detached clean-head archive"
+        agent, runner, _, _, candidate = self.make_agent(
+            active_sha="e" * 64,
+            execute=True,
+            source_mode="clean-head",
+            clean_archive_payloads=(archive_payload, archive_payload),
+            source_repo_root=detached_root,
+        )
+
+        report = agent.run()
+
+        git_stages = [
+            stage
+            for stage in runner.calls
+            if stage == "clean_head_repository"
+            or stage.startswith("clean_head_worktree_")
+            or stage.startswith("clean_head_head_")
+            or stage.startswith("clean_head_tree_")
+            or stage.startswith("clean_head_archive_run_")
+        ]
+        self.assertEqual(9, len(git_stages))
+        self.assertEqual(
+            {detached_root},
+            {runner.working_directories[stage] for stage in git_stages},
+        )
+        self.assertEqual(str(detached_root), report["source"]["repo_root"])
+        self.assertEqual("clean-head", candidate.materialization_mode)
+
+    def test_clean_head_rejects_tracked_changes_and_ignores_untracked_in_query(self) -> None:
+        agent, runner, deployment, _, candidate = self.make_agent(
+            active_sha="e" * 64,
+            execute=True,
+            source_mode="clean-head",
+            tracked_status=" M docs/TODO.md\n",
+        )
+
+        with self.assertRaises(self.agent_module.ReleaseAgentFailure) as raised:
+            agent.run()
+
+        self.assertEqual("clean_head_worktree", raised.exception.report["failed_stage"])
+        self.assertEqual(
+            ["clean_head_repository", "clean_head_worktree_before"],
+            runner.calls,
+        )
+        self.assertIn(
+            "--untracked-files=no",
+            runner.commands["clean_head_worktree_before"],
+        )
+        self.assertEqual([], deployment.calls)
+        self.assertIsNone(candidate.materialization_mode)
+
+    def test_clean_head_non_git_source_fails_before_identity_or_deployment(self) -> None:
+        agent, runner, deployment, _, candidate = self.make_agent(
+            active_sha="e" * 64,
+            execute=True,
+            source_mode="clean-head",
+            fail_stage="clean_head_repository",
+        )
+
+        with self.assertRaises(self.agent_module.ReleaseAgentFailure) as raised:
+            agent.run()
+
+        self.assertEqual("clean_head_repository", raised.exception.report["failed_stage"])
+        self.assertEqual(["clean_head_repository"], runner.calls)
+        self.assertEqual([], deployment.calls)
+        self.assertIsNone(candidate.materialization_mode)
+
+    def test_clean_head_archive_runs_must_be_byte_identical(self) -> None:
+        agent, runner, deployment, _, candidate = self.make_agent(
+            active_sha="e" * 64,
+            execute=True,
+            source_mode="clean-head",
+            clean_archive_payloads=(b"first archive", b"second archive"),
+        )
+
+        with self.assertRaises(self.agent_module.ReleaseAgentFailure) as raised:
+            agent.run()
+
+        self.assertEqual("clean_head_determinism", raised.exception.report["failed_stage"])
+        self.assertEqual(2, len([stage for stage in runner.calls if "archive_run" in stage]))
+        self.assertEqual([], deployment.calls)
+        self.assertIsNone(candidate.materialization_mode)
+
+    def test_clean_head_evidence_binds_exact_head_tree_and_archive(self) -> None:
+        archive_payload = b"deterministic clean-head archive"
+        expected_sha = self.agent_module.sha256_bytes(archive_payload)
+        agent, runner, deployment, _, candidate = self.make_agent(
+            active_sha="e" * 64,
+            execute=True,
+            source_mode="clean-head",
+            clean_archive_payloads=(archive_payload, archive_payload),
+        )
+
+        report = agent.run()
+
+        self.assertTrue(report["ok"])
+        self.assertEqual(expected_sha, report["desired_sha"])
+        self.assertEqual("clean-head", report["source_mode"])
+        self.assertEqual("b" * 40, report["source"]["head"])
+        self.assertEqual("c" * 40, report["source"]["tree"])
+        self.assertEqual(expected_sha, report["source"]["archive"]["sha256"])
+        self.assertEqual(len(archive_payload), report["source"]["archive"]["bytes"])
+        self.assertEqual(2, report["source"]["archive"]["deterministic_runs"])
+        self.assertEqual("clean-head", candidate.materialization_mode)
+        self.assertEqual(expected_sha, candidate.archive_sha256)
+        self.assertEqual(archive_payload, candidate.archive_bytes)
+        self.assertNotIn("release_manifest", runner.calls)
+        self.assertFalse(any(stage.startswith("release_patch_run_") for stage in runner.calls))
+        self.assertIn("promote", deployment.calls)
+        evidence = json.loads((self.root / "evidence.json").read_text(encoding="utf-8"))
+        self.assertEqual(report["source"], evidence["source"])
+        self.assertEqual("clean-head", evidence["source_mode"])
+
     def test_same_deployment_sha_is_a_runtime_checked_noop(self) -> None:
         agent, runner, deployment, runtime, candidate = self.make_agent(
             active_sha="a" * 64,
@@ -402,6 +617,8 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         report = agent.run()
         self.assertTrue(report["ok"])
         self.assertEqual("deployed_ssot_sync_required", report["status"])
+        self.assertEqual("patch", report["source_mode"])
+        self.assertEqual("a" * 64, report["source"]["patch"]["sha256"])
         self.assertEqual("a" * 64, report["active_sha"])
         self.assertEqual("e" * 64, report["previous_sha"])
         self.assertEqual(
@@ -415,6 +632,7 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
                 "web_api_contract",
                 "web_typecheck",
                 "web_build",
+                "source_insecure_context_e2e",
                 "session_e2e",
                 "postdeploy_browser_review",
             ],
@@ -426,12 +644,87 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         )
         self.assertEqual(1, runtime.calls)
         self.assertTrue(candidate.cleaned)
+        postdeploy_command = runner.commands["postdeploy_browser_review"]
+        test_index = postdeploy_command.index("test")
+        first_flag = next(
+            index
+            for index in range(test_index + 1, len(postdeploy_command))
+            if postdeploy_command[index].startswith("--")
+        )
+        self.assertEqual(
+            self.agent_module.POSTDEPLOY_NAS_E2E_SPECS,
+            tuple(postdeploy_command[test_index + 1 : first_flag]),
+        )
+        self.assertNotIn("--grep", postdeploy_command)
+        self.assertEqual(
+            {f"--project={project}" for project in self.agent_module.RELEASE_BROWSER_PROJECTS},
+            {value for value in postdeploy_command if value.startswith("--project=")},
+        )
+        self.assertEqual(
+            self.agent_module.RELEASE_E2E_TIMEOUT_SECONDS,
+            runner.timeouts["postdeploy_browser_review"],
+        )
+        self.assertEqual(
+            self.agent_module.NAS_PREVIEW_TARGET.base_url,
+            runner.environments["postdeploy_browser_review"]["PLAYWRIGHT_BASE_URL"],
+        )
+        self.assertEqual(
+            "1",
+            runner.environments["postdeploy_browser_review"]["PLAYWRIGHT_SKIP_WEB_SERVER"],
+        )
+        self.assertIn(
+            "e2e/self-directed-learning-loop.spec.ts",
+            self.agent_module.POSTDEPLOY_NAS_E2E_SPECS,
+        )
+        self.assertIn(
+            "e2e/deliberate-practice.spec.ts",
+            self.agent_module.POSTDEPLOY_NAS_E2E_SPECS,
+        )
+        self.assertNotIn(
+            "e2e/insecure-context-uuid.spec.ts",
+            self.agent_module.POSTDEPLOY_NAS_E2E_SPECS,
+        )
+        self.assertNotIn(
+            "e2e/returned-practice-db-closed-loop.spec.ts",
+            self.agent_module.POSTDEPLOY_NAS_E2E_SPECS,
+        )
+        self.assertEqual(
+            set(self.agent_module.RELEASE_UI_E2E_SPECS),
+            set(self.agent_module.POSTDEPLOY_NAS_E2E_SPECS)
+            | set(self.agent_module.POSTDEPLOY_SOURCE_ONLY_E2E_SPECS),
+        )
+        self.assertLess(
+            runner.event_log.index("runner:postdeploy_browser_review"),
+            runner.event_log.index("deployment:commit_active_state"),
+        )
         self.assertTrue(
-            set(self.agent_module.RELEASE_UI_E2E_SPECS).issubset(
+            set(self.agent_module.POSTDEPLOY_NAS_E2E_SPECS).issubset(
                 set(runner.commands["session_e2e"])
             )
         )
+        self.assertNotIn(
+            "e2e/insecure-context-uuid.spec.ts",
+            runner.commands["session_e2e"],
+        )
+        source_command = runner.commands["source_insecure_context_e2e"]
+        self.assertIn("e2e/insecure-context-uuid.spec.ts", source_command)
+        self.assertIn("--project=chromium-desktop", source_command)
+        self.assertIn("--project=chromium-mobile", source_command)
+        source_environment = runner.environments["source_insecure_context_e2e"]
+        self.assertNotIn("PLAYWRIGHT_BASE_URL", source_environment)
+        self.assertNotIn("PLAYWRIGHT_SKIP_WEB_SERVER", source_environment)
+        self.assertEqual("127.0.0.1", source_environment["PLAYWRIGHT_HOST"])
+        self.assertEqual(
+            str(self.agent_module.SOURCE_ONLY_E2E_PORT),
+            source_environment["PLAYWRIGHT_PORT"],
+        )
+        self.assertEqual("1", source_environment["CI"])
         self.assertEqual(15 * 60, self.agent_module.RELEASE_E2E_TIMEOUT_SECONDS)
+        self.assertIn(
+            "e2e/insecure-context-uuid.spec.ts",
+            self.agent_module.RELEASE_UI_E2E_SPECS,
+        )
+        self.assertEqual("patch", candidate.materialization_mode)
         self.assertEqual(
             (
                 "14_continuous_improvement.sql",
@@ -445,6 +738,18 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         self.assertEqual("e" * 64, evidence["previous_sha"])
         self.assertEqual("a" * 64, evidence["deployment"]["desired_sha"])
         self.assertEqual("required", evidence["ssot_sync"]["status"])
+        self.assertEqual(
+            list(self.agent_module.POSTDEPLOY_NAS_E2E_SPECS),
+            evidence["browser_review_proof"]["specs"],
+        )
+        self.assertEqual(
+            ["e2e/insecure-context-uuid.spec.ts"],
+            evidence["browser_review_proof"]["source_only_candidate_specs"],
+        )
+        self.assertEqual(
+            ["e2e/returned-practice-db-closed-loop.spec.ts"],
+            evidence["browser_review_proof"]["separate_disposable_db_specs"],
+        )
         self.assertEqual(
             [
                 "docs/dev_dashboard.html",
@@ -480,7 +785,7 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         self.assertTrue(candidate.cleaned)
 
     def test_rollback_image_mismatch_remains_a_hard_failure(self) -> None:
-        agent, _, deployment, _, _ = self.make_agent(
+        agent, runner, deployment, _, _ = self.make_agent(
             active_sha="e" * 64,
             execute=True,
             fail_stage="postdeploy_browser_review",
@@ -491,6 +796,11 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         self.assertEqual("failed", raised.exception.report["rollback"]["status"])
         self.assertIn("rollback image proof mismatch", raised.exception.report["rollback"]["error"])
         self.assertIn("verify_rollback", deployment.calls)
+        self.assertNotIn("commit_active_state", deployment.calls)
+        self.assertLess(
+            runner.event_log.index("runner:postdeploy_browser_review"),
+            runner.event_log.index("deployment:rollback"),
+        )
 
     def test_postpromotion_runtime_retries_only_transient_readiness_failures(self) -> None:
         agent, _, deployment, _, candidate = self.make_agent(
@@ -653,6 +963,50 @@ class OutcomeReleaseAgentTests(unittest.TestCase):
         self.assertEqual(b"candidate\r\n", (candidate / "README.md").read_bytes())
         manager.cleanup()
 
+    def test_clean_head_candidate_is_archive_only_with_platform_normalization(self) -> None:
+        runner = CandidateArchiveRunner(self.agent_module)
+        manager = self.agent_module.CleanCandidateManager(self.root, runner)
+        archive_path = self.root / "clean-head.tar"
+        source = self.root / "source.txt"
+        source.write_bytes(b"exact committed bytes\r\n")
+        generated_api = self.root / "api.gen.ts"
+        generated_api.write_bytes(b"export type Exact = true;\r\n")
+        shell_script = self.root / "99_app_role.sh"
+        shell_script.write_bytes(b"#!/usr/bin/env bash\r\necho ready\r\n")
+        with tarfile.open(archive_path, "w") as archive:
+            archive.add(source, arcname="source.txt")
+            archive.add(generated_api, arcname="apps/web/src/lib/api.gen.ts")
+            archive.add(shell_script, arcname="infra/db/init/99_app_role.sh")
+        expected_sha = self.agent_module.sha256_bytes(archive_path.read_bytes())
+
+        candidate = manager.materialize_archive(archive_path, expected_sha)
+
+        self.assertEqual(b"exact committed bytes\r\n", (candidate / "source.txt").read_bytes())
+        self.assertEqual(
+            b"export type Exact = true;\n",
+            (candidate / "apps/web/src/lib/api.gen.ts").read_bytes(),
+        )
+        self.assertEqual(
+            b"#!/usr/bin/env bash\necho ready\n",
+            (candidate / "infra/db/init/99_app_role.sh").read_bytes(),
+        )
+        self.assertEqual([], runner.calls)
+        manager.cleanup()
+
+    def test_clean_head_candidate_rejects_archive_sha_drift(self) -> None:
+        runner = CandidateArchiveRunner(self.agent_module)
+        manager = self.agent_module.CleanCandidateManager(self.root, runner)
+        archive_path = self.root / "clean-head.tar"
+        archive_path.write_bytes(b"not the bound archive")
+
+        with self.assertRaisesRegex(
+            self.agent_module.StageFailure,
+            "archive SHA drifted",
+        ):
+            manager.materialize_archive(archive_path, "a" * 64)
+
+        self.assertEqual([], runner.calls)
+
     def test_active_state_rejects_noncanonical_compose_path_before_snapshot(self) -> None:
         root = "/volume1/docker/vignette-preview-20260807"
         runner = ActiveStateRunner(
diff --git a/scripts/test_public_runtime_watchdog_provenance.py b/scripts/test_public_runtime_watchdog_provenance.py
new file mode 100644
index 0000000..e5862d5
--- /dev/null
+++ b/scripts/test_public_runtime_watchdog_provenance.py
@@ -0,0 +1,408 @@
+from __future__ import annotations
+
+import hashlib
+import shutil
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+SCRIPTS = Path(__file__).resolve().parent
+WATCHDOG = SCRIPTS / "watch-public-runtime.ps1"
+INSTALLER = SCRIPTS / "install-public-runtime-task.ps1"
+BOOT = SCRIPTS / "boot-public-runtime.ps1"
+BOOT_REGISTER = SCRIPTS / "register-boot-task.ps1"
+HIDDEN_TRIGGER = SCRIPTS / "watch-public-runtime-hidden.vbs"
+START = SCRIPTS / "start-public-runtime.ps1"
+REPO_ROOT = SCRIPTS.parent
+RUNBOOK = REPO_ROOT / "docs" / "ops" / "public-runtime-watchdog.md"
+LOCAL_DEVELOPMENT = REPO_ROOT / "docs" / "guides" / "local-development.md"
+WATCHDOG_SOURCE = WATCHDOG.read_text(encoding="utf-8")
+INSTALLER_SOURCE = INSTALLER.read_text(encoding="utf-8")
+BOOT_SOURCE = BOOT.read_text(encoding="utf-8")
+BOOT_REGISTER_SOURCE = BOOT_REGISTER.read_text(encoding="utf-8")
+HIDDEN_TRIGGER_SOURCE = HIDDEN_TRIGGER.read_text(encoding="utf-8")
+RUNBOOK_SOURCE = RUNBOOK.read_text(encoding="utf-8")
+LOCAL_DEVELOPMENT_SOURCE = LOCAL_DEVELOPMENT.read_text(encoding="utf-8")
+
+
+def sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+class PublicRuntimeWatchdogProvenanceTest(unittest.TestCase):
+    def test_watchdog_requires_exact_source_and_script_pins(self) -> None:
+        for expected in (
+            "[string]$StableSourceRoot",
+            "[string]$ExpectedSourceCommit",
+            "[string]$ExpectedSourceTree",
+            "[string]$ExpectedWatchdogSha256",
+            "[string]$ExpectedStartScriptSha256",
+            'symbolic-ref --quiet HEAD',
+            '"status", "--porcelain=v1", "--untracked-files=normal"',
+            '"ls-files", "--error-unmatch"',
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, WATCHDOG_SOURCE)
+        self.assertGreaterEqual(WATCHDOG_SOURCE.count("[Parameter(Mandatory = $true)]"), 5)
+
+    def test_provenance_gate_precedes_health_and_runtime_recovery(self) -> None:
+        gate_comment = WATCHDOG_SOURCE.index(
+            "# health probe, failcount 기록, 프로세스 재기동보다 먼저"
+        )
+        gate = WATCHDOG_SOURCE.index("Assert-StableSourceProvenance", gate_comment)
+        health = WATCHDOG_SOURCE.index("$checks = @(")
+        restart = WATCHDOG_SOURCE.index("& $startScript @startArgs")
+        failcount_write = WATCHDOG_SOURCE.index("Set-FailCount 0", health)
+        self.assertLess(gate, health)
+        self.assertLess(gate, restart)
+        self.assertLess(gate, failcount_write)
+
+    def test_installer_pins_a_detached_clean_release_in_task_action(self) -> None:
+        for expected in (
+            "[Parameter(Mandatory = $true)]",
+            "[string]$StableSourceRoot",
+            "symbolic-ref --quiet HEAD",
+            '"status", "--porcelain=v1", "--untracked-files=normal"',
+            '"-ExpectedSourceCommit $sourceCommit"',
+            '"-ExpectedSourceTree $sourceTree"',
+            '"-ExpectedWatchdogSha256 $watchdogSha256"',
+            '"-ExpectedStartScriptSha256 $startScriptSha256"',
+            "-WorkingDirectory $resolvedSourceRoot",
+            "Watchdog installer is not executing from the pinned stable source root",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, INSTALLER_SOURCE)
+        dirty_gate = INSTALLER_SOURCE.index("Stable source is not clean")
+        task_registration = INSTALLER_SOURCE.index("Register-ScheduledTask")
+        self.assertLess(dirty_gate, task_registration)
+
+    def test_boot_recovery_uses_the_same_gate_before_docker_or_process_mutation(self) -> None:
+        for expected in (
+            "[string]$StableSourceRoot",
+            "[string]$ExpectedSourceCommit",
+            "[string]$ExpectedSourceTree",
+            "[string]$ExpectedBootScriptSha256",
+            "[string]$ExpectedStartScriptSha256",
+            "symbolic-ref --quiet HEAD",
+            '"status", "--porcelain=v1", "--untracked-files=normal"',
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, BOOT_SOURCE)
+        gate_comment = BOOT_SOURCE.index(
+            "# Docker/DB/process mutation보다 먼저 stable source를 매 실행 재검증한다."
+        )
+        gate = BOOT_SOURCE.index("Assert-StableSourceProvenance", gate_comment)
+        docker_mutation = BOOT_SOURCE.index("docker.exe update")
+        runtime_recovery = BOOT_SOURCE.index("-File $startScript")
+        self.assertLess(gate, docker_mutation)
+        self.assertLess(gate, runtime_recovery)
+
+    def test_boot_task_registration_pins_the_same_detached_release(self) -> None:
+        for expected in (
+            "[string]$StableSourceRoot",
+            "symbolic-ref --quiet HEAD",
+            '"status", "--porcelain=v1", "--untracked-files=normal"',
+            '"-ExpectedSourceCommit $sourceCommit"',
+            '"-ExpectedSourceTree $sourceTree"',
+            '"-ExpectedBootScriptSha256 $bootScriptSha256"',
+            '"-ExpectedStartScriptSha256 $startScriptSha256"',
+            "-WorkingDirectory $resolvedSourceRoot",
+            "Boot task registrar is not executing from the pinned stable source root",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, BOOT_REGISTER_SOURCE)
+        dirty_gate = BOOT_REGISTER_SOURCE.index("Stable source is not clean")
+        task_registration = BOOT_REGISTER_SOURCE.index("Register-ScheduledTask")
+        self.assertLess(dirty_gate, task_registration)
+
+    def test_hidden_trigger_never_executes_a_workspace_script_directly(self) -> None:
+        for expected in (
+            "VignettePublicRuntimeWatchdog",
+            "-StableSourceRoot",
+            "-ExpectedSourceCommit",
+            "-ExpectedSourceTree",
+            "-ExpectedWatchdogSha256",
+            "-ExpectedStartScriptSha256",
+            "WorkingDirectory",
+            "Pinned watchdog script path does not match its working directory",
+            "Pinned watchdog source root does not match its working directory",
+            "Start-ScheduledTask",
+            "Legacy shared-worktree watchdog action is forbidden",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, HIDDEN_TRIGGER_SOURCE)
+        self.assertIn(
+            "Join-Path $root 'scripts\\watch-public-runtime.ps1'",
+            HIDDEN_TRIGGER_SOURCE,
+        )
+        self.assertNotIn('objShell.Run "powershell.exe', HIDDEN_TRIGGER_SOURCE)
+        self.assertNotIn("D:\\workspace\\vignette", HIDDEN_TRIGGER_SOURCE)
+        marker_gate = HIDDEN_TRIGGER_SOURCE.index("foreach($marker in $required)")
+        task_trigger = HIDDEN_TRIGGER_SOURCE.rindex("Start-ScheduledTask")
+        self.assertLess(marker_gate, task_trigger)
+
+    def test_active_docs_only_show_the_pinned_release_workflow(self) -> None:
+        stale_commands = (
+            "powershell -NoProfile -ExecutionPolicy Bypass -File scripts\\watch-public-runtime.ps1 -CheckOnly",
+            "powershell -NoProfile -ExecutionPolicy Bypass -File scripts\\install-public-runtime-task.ps1 -RunNow",
+        )
+        for source in (RUNBOOK_SOURCE, LOCAL_DEVELOPMENT_SOURCE):
+            for stale in stale_commands:
+                with self.subTest(document=source[:32], stale=stale):
+                    self.assertNotIn(stale, source)
+        for expected in (
+            "detached HEAD",
+            "-StableSourceRoot",
+            "-ExpectedSourceCommit",
+            "-ExpectedSourceTree",
+            "-ExpectedWatchdogSha256",
+            "-ExpectedStartScriptSha256",
+            "--porcelain=v1 --untracked-files=normal",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, RUNBOOK_SOURCE)
+        self.assertIn("-StableSourceRoot", LOCAL_DEVELOPMENT_SOURCE)
+        self.assertIn("watch-public-runtime-hidden.vbs", LOCAL_DEVELOPMENT_SOURCE)
+
+    @unittest.skipUnless(shutil.which("git.exe"), "git.exe is unavailable")
+    @unittest.skipUnless(shutil.which("powershell.exe"), "Windows PowerShell 5.1 is unavailable")
+    def test_dirty_detached_release_fails_before_health_or_runtime_mutation(self) -> None:
+        with tempfile.TemporaryDirectory(prefix="vignette-watchdog-") as temp:
+            root = Path(temp)
+            scripts = root / "scripts"
+            scripts.mkdir()
+            copied_watchdog = scripts / WATCHDOG.name
+            copied_installer = scripts / INSTALLER.name
+            copied_boot = scripts / BOOT.name
+            copied_boot_register = scripts / BOOT_REGISTER.name
+            copied_start = scripts / START.name
+            shutil.copy2(WATCHDOG, copied_watchdog)
+            shutil.copy2(INSTALLER, copied_installer)
+            shutil.copy2(BOOT, copied_boot)
+            shutil.copy2(BOOT_REGISTER, copied_boot_register)
+            shutil.copy2(START, copied_start)
+
+            self._git(root, "init")
+            self._git(root, "config", "user.name", "Watchdog Contract Test")
+            self._git(root, "config", "user.email", "watchdog-test@example.invalid")
+            self._git(
+                root,
+                "add",
+                "scripts/watch-public-runtime.ps1",
+                "scripts/install-public-runtime-task.ps1",
+                "scripts/boot-public-runtime.ps1",
+                "scripts/register-boot-task.ps1",
+                "scripts/start-public-runtime.ps1",
+            )
+            self._git(root, "commit", "-m", "watchdog fixture")
+            self._git(root, "checkout", "--detach")
+            commit = self._git(root, "rev-parse", "HEAD").stdout.strip()
+            tree = self._git(root, "rev-parse", "HEAD^{tree}").stdout.strip()
+            watchdog_hash = sha256(copied_watchdog)
+            boot_hash = sha256(copied_boot)
+            start_hash = sha256(copied_start)
+
+            with copied_start.open("ab") as stream:
+                stream.write(b"\n# dirty fixture\n")
+
+            completed = subprocess.run(
+                [
+                    shutil.which("powershell.exe") or "powershell.exe",
+                    "-NoProfile",
+                    "-ExecutionPolicy",
+                    "Bypass",
+                    "-File",
+                    str(copied_watchdog),
+                    "-StableSourceRoot",
+                    str(root),
+                    "-ExpectedSourceCommit",
+                    commit,
+                    "-ExpectedSourceTree",
+                    tree,
+                    "-ExpectedWatchdogSha256",
+                    watchdog_hash,
+                    "-ExpectedStartScriptSha256",
+                    start_hash,
+                    "-CheckOnly",
+                    "-SkipPublicHealth",
+                    "-SkipCloudflaredRestart",
+                ],
+                check=False,
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                timeout=30,
+            )
+            detail = f"{completed.stdout}\n{completed.stderr}"
+            self.assertNotEqual(completed.returncode, 0, detail)
+            self.assertIn("Stable source is not clean", detail)
+            self.assertFalse((root / "public-runtime-watchdog.failcount").exists())
+            self.assertFalse((root / "public-runtime-watchdog.log").exists())
+
+            boot_completed = subprocess.run(
+                [
+                    shutil.which("powershell.exe") or "powershell.exe",
+                    "-NoProfile",
+                    "-ExecutionPolicy",
+                    "Bypass",
+                    "-File",
+                    str(copied_boot),
+                    "-StableSourceRoot",
+                    str(root),
+                    "-ExpectedSourceCommit",
+                    commit,
+                    "-ExpectedSourceTree",
+                    tree,
+                    "-ExpectedBootScriptSha256",
+                    boot_hash,
+                    "-ExpectedStartScriptSha256",
+                    start_hash,
+                ],
+                check=False,
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                timeout=30,
+            )
+            boot_detail = f"{boot_completed.stdout}\n{boot_completed.stderr}"
+            self.assertNotEqual(boot_completed.returncode, 0, boot_detail)
+            self.assertIn("Stable source is not clean", boot_detail)
+            self.assertFalse((root / "boot-public-runtime.log").exists())
+
+            for registrar in (copied_installer, copied_boot_register):
+                register_completed = subprocess.run(
+                    [
+                        shutil.which("powershell.exe") or "powershell.exe",
+                        "-NoProfile",
+                        "-ExecutionPolicy",
+                        "Bypass",
+                        "-File",
+                        str(registrar),
+                        "-StableSourceRoot",
+                        str(root),
+                    ],
+                    check=False,
+                    capture_output=True,
+                    text=True,
+                    encoding="utf-8",
+                    errors="replace",
+                    timeout=30,
+                )
+                register_detail = (
+                    f"{register_completed.stdout}\n{register_completed.stderr}"
+                )
+                with self.subTest(registrar=registrar.name):
+                    self.assertNotEqual(register_completed.returncode, 0, register_detail)
+                    self.assertIn("Stable source is not clean", register_detail)
+
+    def test_windows_powershell_51_parser_accepts_scripts(self) -> None:
+        powershell = shutil.which("powershell.exe")
+        if powershell is None:
+            self.skipTest("Windows PowerShell 5.1 is unavailable")
+        for script in (WATCHDOG, INSTALLER, BOOT, BOOT_REGISTER):
+            escaped = str(script.resolve()).replace("'", "''")
+            command = (
+                "$tokens=$null; $errors=$null; "
+                "[System.Management.Automation.Language.Parser]::ParseFile("
+                f"'{escaped}', [ref]$tokens, [ref]$errors) | Out-Null; "
+                "if ($errors.Count -gt 0) { $errors | ForEach-Object { Write-Error $_ }; exit 1 }; "
+                "exit 0"
+            )
+            completed = subprocess.run(
+                [powershell, "-NoProfile", "-Command", command],
+                check=False,
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+            )
+            with self.subTest(script=script.name):
+                self.assertEqual(completed.returncode, 0, completed.stderr)
+
+    def test_windows_script_host_accepts_hidden_trigger_syntax(self) -> None:
+        cscript = shutil.which("cscript.exe")
+        if cscript is None:
+            self.skipTest("Windows Script Host is unavailable")
+        completed = subprocess.run(
+            [cscript, "//nologo", str(HIDDEN_TRIGGER), "syntax-only"],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+
+    def test_hidden_trigger_command_accepts_only_a_structurally_pinned_task(self) -> None:
+        cscript = shutil.which("cscript.exe")
+        powershell = shutil.which("powershell.exe")
+        if cscript is None or powershell is None:
+            self.skipTest("Windows Script Host or PowerShell 5.1 is unavailable")
+        rendered = subprocess.run(
+            [cscript, "//nologo", str(HIDDEN_TRIGGER), "print-command"],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        self.assertEqual(rendered.returncode, 0, rendered.stderr)
+        prefix = (
+            "powershell.exe -NoProfile -ExecutionPolicy Bypass "
+            '-WindowStyle Hidden -Command "'
+        )
+        wrapped = rendered.stdout.strip()
+        self.assertTrue(wrapped.startswith(prefix), wrapped)
+        self.assertTrue(wrapped.endswith('"'), wrapped)
+        command = wrapped[len(prefix) : -1].replace('""', '"')
+
+        root = r"C:\Pinned Vignette Release"
+        arguments = (
+            f'-File "{root}\\scripts\\watch-public-runtime.ps1" '
+            f'-StableSourceRoot "{root}" '
+            f"-ExpectedSourceCommit {'a' * 40} "
+            f"-ExpectedSourceTree {'b' * 40} "
+            f"-ExpectedWatchdogSha256 {'c' * 64} "
+            f"-ExpectedStartScriptSha256 {'d' * 64}"
+        )
+        fixture = (
+            "$script:watchdogTriggered=$false;"
+            "function Get-ScheduledTask { param($TaskName,$ErrorAction) "
+            "$action=[pscustomobject]@{"
+            "Execute='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';"
+            f"WorkingDirectory='{root}';Arguments='{arguments}'"
+            "};[pscustomobject]@{Actions=@($action)}};"
+            "function Start-ScheduledTask { param($TaskName) "
+            "$script:watchdogTriggered=$true };"
+            f"{command};"
+            "if(-not $script:watchdogTriggered){exit 9};exit 0"
+        )
+        checked = subprocess.run(
+            [powershell, "-NoProfile", "-Command", fixture],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        self.assertEqual(checked.returncode, 0, checked.stderr)
+
+    def _git(self, root: Path, *args: str) -> subprocess.CompletedProcess[str]:
+        completed = subprocess.run(
+            [shutil.which("git.exe") or "git.exe", "-C", str(root), *args],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+        return completed
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_public_voice_sidecar_probe.py b/scripts/test_public_voice_sidecar_probe.py
new file mode 100644
index 0000000..705a67f
--- /dev/null
+++ b/scripts/test_public_voice_sidecar_probe.py
@@ -0,0 +1,144 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+import unittest
+from pathlib import Path
+from urllib.parse import parse_qs, urlsplit
+
+
+SCRIPT_PATH = Path(__file__).with_name("probe-public-voice-sidecars.py")
+SPEC = importlib.util.spec_from_file_location("public_voice_sidecar_probe", SCRIPT_PATH)
+assert SPEC is not None and SPEC.loader is not None
+MODULE = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = MODULE
+SPEC.loader.exec_module(MODULE)
+
+
+class SttProbeContractTest(unittest.TestCase):
+    def _payload(self, **overrides: object) -> dict[str, object]:
+        payload: dict[str, object] = {
+            "type": "ready",
+            "provider": "local_whisper",
+            "model": "small",
+            "language": "ko",
+            "device": "cpu",
+            "compute_type": "int8",
+            "sample_rate": 16_000,
+        }
+        payload.update(overrides)
+        return payload
+
+    def test_exact_public_metadata_is_accepted(self) -> None:
+        result = MODULE.validate_stt_ready(
+            self._payload(),
+            provider="local_whisper",
+            model="small",
+            language="ko",
+            device="cpu",
+        )
+        self.assertEqual(result["compute_type"], "int8")
+
+    def test_provider_model_device_and_compute_type_mismatch_fail_closed(self) -> None:
+        for field, value in (
+            ("provider", "deepgram"),
+            ("model", "large-v3"),
+            ("device", "cuda"),
+            ("compute_type", "float16"),
+        ):
+            with self.subTest(field=field):
+                with self.assertRaises(MODULE.ProbeError):
+                    MODULE.validate_stt_ready(
+                        self._payload(**{field: value}),
+                        provider="local_whisper",
+                        model="small",
+                        language="ko",
+                        device="cpu",
+                    )
+
+    def test_probe_url_replaces_query_with_exact_stream_contract(self) -> None:
+        url = MODULE.build_stt_probe_url(
+            "ws://127.0.0.1:9882/v1/listen?model=base&channels=2",
+            model="small",
+            language="ko",
+        )
+        query = parse_qs(urlsplit(url).query)
+        self.assertEqual(query["model"], ["small"])
+        self.assertEqual(query["language"], ["ko"])
+        self.assertEqual(query["sample_rate"], ["16000"])
+        self.assertEqual(query["channels"], ["1"])
+
+    def test_non_loopback_urls_and_embedded_credentials_are_rejected(self) -> None:
+        for url in (
+            "wss://example.com/v1/listen",
+            "ws://user:secret@127.0.0.1:9882/v1/listen",
+        ):
+            with self.subTest(url=url):
+                with self.assertRaises(MODULE.ProbeError):
+                    MODULE.build_stt_probe_url(url, model="small", language="ko")
+
+
+class TtsProbeContractTest(unittest.TestCase):
+    def _payload(self, **overrides: object) -> dict[str, object]:
+        payload: dict[str, object] = {
+            "status": "ok",
+            "provider": "melotts",
+            "model": "melotts-korean",
+            "language": "KR",
+            "license": "MIT",
+            "reference_policy": "pretrained-multispeaker-no-external-reference",
+            "sample_rate": 44_100,
+            "speakers": ["KR"],
+        }
+        payload.update(overrides)
+        return payload
+
+    def test_exact_public_metadata_is_accepted(self) -> None:
+        result = MODULE.validate_tts_health(
+            self._payload(),
+            provider="melotts",
+            model="melotts-korean",
+            language="KR",
+        )
+        self.assertEqual(result["license"], "MIT")
+
+    def test_provider_model_license_and_reference_mismatch_fail_closed(self) -> None:
+        for field, value in (
+            ("provider", "openai"),
+            ("model", "other"),
+            ("license", "unknown"),
+            ("reference_policy", "external-reference"),
+        ):
+            with self.subTest(field=field):
+                with self.assertRaises(MODULE.ProbeError):
+                    MODULE.validate_tts_health(
+                        self._payload(**{field: value}),
+                        provider="melotts",
+                        model="melotts-korean",
+                        language="KR",
+                    )
+
+    def test_empty_speaker_catalog_and_invalid_sample_rate_fail_closed(self) -> None:
+        for override in ({"speakers": []}, {"sample_rate": 0}):
+            with self.subTest(override=override):
+                with self.assertRaises(MODULE.ProbeError):
+                    MODULE.validate_tts_health(
+                        self._payload(**override),
+                        provider="melotts",
+                        model="melotts-korean",
+                        language="KR",
+                    )
+
+
+class CliContractTest(unittest.TestCase):
+    def test_defaults_are_the_public_local_stack(self) -> None:
+        args = MODULE.build_parser().parse_args([])
+        self.assertEqual(args.stt_provider, "local_whisper")
+        self.assertEqual(args.stt_model, "small")
+        self.assertEqual(args.stt_device, "cpu")
+        self.assertEqual(args.tts_provider, "melotts")
+        self.assertEqual(args.tts_model, "melotts-korean")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_run_g7_external_proof_window.py b/scripts/test_run_g7_external_proof_window.py
index 407a5a5..6315768 100644
--- a/scripts/test_run_g7_external_proof_window.py
+++ b/scripts/test_run_g7_external_proof_window.py
@@ -18,20 +18,38 @@ SPEC.loader.exec_module(MODULE)
 def args(**overrides):
     base = {
         "wss_url": "wss://api.example.test/voice/ws",
-        "origin": "https://api.example.test",
+        "origin": "https://web.example.test",
+        "allowed_browser_origins": ["https://web.example.test"],
         "admin_runtime_url": "https://api.example.test/admin/voice-runtime",
+        "topology_mode": "linux-compose",
         "compose_project": "vignette",
         "api_container": "vignette-api-1",
         "api_image_digest": "sha256:" + "a" * 64,
         "caddy_container": "vignette-proxy-1",
         "caddy_image_digest": "sha256:" + "b" * 64,
+        "repo_root": None,
+        "git_sha": None,
+        "git_tree_sha": None,
+        "runner_script_sha256": None,
+        "collector_script_sha256": None,
+        "checker_script_sha256": None,
+        "psutil_version": None,
+        "api_pid": None,
+        "api_executable_name": None,
+        "api_executable_sha256": None,
+        "api_cwd": None,
+        "api_listen_port": None,
+        "cloudflared_pid": None,
+        "cloudflared_executable_name": None,
+        "cloudflared_executable_sha256": None,
+        "cloudflared_cwd": None,
         "expected_stt_provider": "local_whisper",
-        "expected_stt_model": "large-v3",
+        "expected_stt_model": "small",
         "expected_tts_provider": "melotts",
         "expected_tts_model": "melotts-korean",
         "microphone_device": "",
         "confirm_physical_capture": False,
-        "duration_seconds": 3_000.0,
+        "duration_seconds": 3_120.0,
         "runtime_interval_seconds": 100.0,
         "topology_interval_seconds": 100.0,
         "human_voice_gain": Path("pack.json"),
@@ -50,33 +68,110 @@ class FakeCompleted:
 
 
 class HostAlignmentTest(unittest.TestCase):
-    def test_matching_hosts_are_accepted(self) -> None:
+    def test_matching_transport_hosts_are_accepted(self) -> None:
         host = MODULE.assert_single_host(
             "wss://api.example.test/voice/ws",
-            "https://api.example.test",
             "https://api.example.test/admin/voice-runtime",
         )
         self.assertEqual(host, "api.example.test")
 
-    def test_mismatched_hosts_fail_closed(self) -> None:
-        with self.assertRaises(MODULE.WindowError):
+    def test_mismatched_transport_hosts_fail_closed_without_echoing_hosts(self) -> None:
+        with self.assertRaises(MODULE.WindowError) as caught:
             MODULE.assert_single_host(
-                "wss://api.example.test/voice/ws", "https://other.example.test"
+                "wss://api.example.test/voice/ws",
+                "https://private-tenant.example.test/admin/voice-runtime",
             )
+        self.assertEqual("transport_hosts_must_match", str(caught.exception))
+        self.assertNotIn("private-tenant", str(caught.exception))
 
-    def test_plan_rejects_a_split_window(self) -> None:
-        with self.assertRaises(MODULE.WindowError):
+    def test_browser_origin_is_independent_from_transport_host(self) -> None:
+        legs = MODULE.plan_legs(
+            args(microphone_device="mic", confirm_physical_capture=True),
+            Path("out"),
+            admin_probe=lambda origin: ["/admin/voice-runtime"],
+        )
+        self.assertEqual(legs[0].argv[legs[0].argv.index("--origin") + 1],
+                         "https://web.example.test")
+
+    def test_plan_rejects_a_split_transport_window(self) -> None:
+        with self.assertRaises(MODULE.WindowError) as caught:
             MODULE.plan_legs(
                 args(admin_runtime_url="https://elsewhere.test/admin/voice-runtime",
                      microphone_device="mic", confirm_physical_capture=True),
                 Path("out"),
                 admin_probe=lambda origin: ["/admin/voice-runtime"],
             )
+        self.assertEqual("transport_hosts_must_match", str(caught.exception))
+
+    def test_browser_origin_requires_an_explicit_allowlist_match(self) -> None:
+        with self.assertRaises(MODULE.WindowError) as caught:
+            MODULE.plan_legs(
+                args(origin="https://unlisted.example.test"),
+                Path("out"),
+                admin_probe=lambda origin: ["/admin/voice-runtime"],
+            )
+        self.assertEqual("browser_origin_not_allowed", str(caught.exception))
+
+    def test_added_origin_does_not_remove_the_public_default(self) -> None:
+        normalized = MODULE.assert_browser_origin_allowed(
+            MODULE.DEFAULT_BROWSER_ORIGIN, ["https://preview.example.test"]
+        )
+        self.assertEqual(MODULE.DEFAULT_BROWSER_ORIGIN, normalized)
+
+    def test_transport_schemes_fail_closed_without_reflecting_urls(self) -> None:
+        cases = (
+            (
+                "ws://private-wss.example.test/voice/ws?token=secret",
+                "https://api.example.test/admin/voice-runtime",
+                "wss_url_scheme_invalid",
+            ),
+            (
+                "wss://api.example.test/voice/ws",
+                "http://private-admin.example.test/admin/voice-runtime?email=secret",
+                "admin_runtime_url_scheme_invalid",
+            ),
+        )
+        for wss_url, admin_url, expected in cases:
+            with self.subTest(expected=expected):
+                with self.assertRaises(MODULE.WindowError) as caught:
+                    MODULE.assert_transport_schemes(wss_url, admin_url)
+                self.assertEqual(expected, str(caught.exception))
+                self.assertNotIn("secret", str(caught.exception))
+
+    def test_browser_origin_query_is_rejected_without_echoing_it(self) -> None:
+        secret_query = "https://web.example.test?email=person@example.test"
+        with self.assertRaises(MODULE.WindowError) as caught:
+            MODULE.assert_browser_origin_allowed(
+                secret_query, ["https://web.example.test"]
+            )
+        self.assertEqual("browser_origin_invalid", str(caught.exception))
+        self.assertNotIn("person@example.test", str(caught.exception))
+
+    def test_public_parser_defaults_match_browser_and_transport_contract(self) -> None:
+        parser = MODULE.build_parser()
+        parsed = parser.parse_args(["--out-dir", "out"])
+        self.assertEqual(MODULE.DEFAULT_WSS_URL, parsed.wss_url)
+        self.assertEqual(MODULE.DEFAULT_BROWSER_ORIGIN, parsed.origin)
+        self.assertEqual(MODULE.DEFAULT_ADMIN_RUNTIME_URL, parsed.admin_runtime_url)
+        self.assertEqual(3_120.0, parsed.duration_seconds)
+        self.assertIsNone(parsed.allowed_browser_origins)
+        help_text = parser.format_help()
+        for expected in (
+            "https://vignette.chanpaca.net",
+            "wss://api-vignette.chanpaca.net/voice/ws",
+            "stt_provider=local_whisper stt_model=small",
+            "tts_provider=melotts tts_model=melotts-korean",
+            "3120초",
+        ):
+            self.assertIn(expected, help_text)
 
 
 class SamplePlanTest(unittest.TestCase):
     def test_samples_cover_the_whole_window(self) -> None:
-        self.assertEqual(MODULE.sample_plan(3_000.0, 100.0), 31)
+        self.assertEqual(MODULE.sample_plan(3_120.0, 100.0), 33)
+
+    def test_fractional_interval_always_gets_a_terminal_sample(self) -> None:
+        self.assertEqual(MODULE.sample_plan(3_121.0, 100.0), 33)
 
     def test_invalid_plan_fails_closed(self) -> None:
         for duration, interval in ((0, 100.0), (3_000.0, 0)):
@@ -115,11 +210,14 @@ class ConsentGateTest(unittest.TestCase):
         self.assertNotIn("--confirm-physical-capture", leg.argv)
         self.assertNotIn("--microphone-device", leg.argv)
 
-    def test_production_window_shorter_than_fifty_minutes_is_rejected(self) -> None:
+    def test_three_thousand_second_capture_is_rejected_without_skew_margin(self) -> None:
         with self.assertRaises(MODULE.WindowError) as ctx:
-            MODULE.validate(args(duration_seconds=600.0))
+            MODULE.validate(args(duration_seconds=3_000.0))
         self.assertEqual(str(ctx.exception), "production_window_too_short")
 
+    def test_fifty_two_minute_capture_is_accepted(self) -> None:
+        MODULE.validate(args(duration_seconds=3_120.0))
+
     def test_production_run_requires_the_human_pack(self) -> None:
         with self.assertRaises(MODULE.WindowError) as ctx:
             MODULE.validate(args(human_voice_gain=None))
@@ -145,16 +243,88 @@ class LegCompositionTest(unittest.TestCase):
             leg.argv[leg.argv.index("--public-host") + 1], "api.example.test"
         )
 
-    def test_all_three_legs_share_one_window_length(self) -> None:
+    def test_windows_topology_leg_passes_exact_process_pins(self) -> None:
+        windows_args = args(
+            topology_mode="windows-host",
+            compose_project=None,
+            api_container=None,
+            api_image_digest=None,
+            caddy_container=None,
+            caddy_image_digest=None,
+            repo_root=r"D:\workspace\vignette",
+            git_sha="5" * 40,
+            git_tree_sha="6" * 40,
+            runner_script_sha256="7" * 64,
+            collector_script_sha256="8" * 64,
+            checker_script_sha256="9" * 64,
+            psutil_version="7.0.0",
+            api_pid=301,
+            api_executable_name="python.exe",
+            api_executable_sha256="3" * 64,
+            api_cwd=r"D:\workspace\vignette\apps\api",
+            api_listen_port=8001,
+            cloudflared_pid=302,
+            cloudflared_executable_name="cloudflared.exe",
+            cloudflared_executable_sha256="4" * 64,
+            cloudflared_cwd=r"D:\workspace\vignette",
+        )
+        MODULE.validate(windows_args)
+        leg = MODULE.build_topology_leg(windows_args, Path("topology.json"))
+
+        self.assertEqual("windows-host", leg.argv[leg.argv.index("--topology-mode") + 1])
+        self.assertEqual("301", leg.argv[leg.argv.index("--api-pid") + 1])
+        self.assertEqual(
+            "6" * 40, leg.argv[leg.argv.index("--git-tree-sha") + 1]
+        )
+        self.assertEqual(
+            "7" * 64, leg.argv[leg.argv.index("--runner-script-sha256") + 1]
+        )
+        self.assertEqual(
+            "8" * 64,
+            leg.argv[leg.argv.index("--collector-script-sha256") + 1],
+        )
+        self.assertEqual(
+            "9" * 64, leg.argv[leg.argv.index("--checker-script-sha256") + 1]
+        )
+        self.assertEqual("7.0.0", leg.argv[leg.argv.index("--psutil-version") + 1])
+        self.assertEqual(
+            "4" * 64,
+            leg.argv[leg.argv.index("--cloudflared-executable-sha256") + 1],
+        )
+        self.assertNotIn("--compose-project", leg.argv)
+
+    def test_each_topology_mode_requires_its_own_pins(self) -> None:
+        cases = (
+            (args(topology_mode="unknown"), "topology_mode_invalid"),
+            (args(compose_project=None), "topology_argument_required:compose-project"),
+            (
+                args(
+                    topology_mode="windows-host",
+                    compose_project=None,
+                    api_container=None,
+                    api_image_digest=None,
+                    caddy_container=None,
+                    caddy_image_digest=None,
+                ),
+                "topology_argument_required:repo-root",
+            ),
+        )
+        for invalid, failure in cases:
+            with self.subTest(failure=failure):
+                with self.assertRaises(MODULE.WindowError) as caught:
+                    MODULE.validate(invalid)
+                self.assertEqual(failure, str(caught.exception))
+
+    def test_all_three_legs_share_the_margin_extended_window_length(self) -> None:
         legs = MODULE.plan_legs(
-            args(rehearse=True, duration_seconds=3_000.0), Path("out"),
+            args(rehearse=True, duration_seconds=3_120.0), Path("out"),
             admin_probe=lambda origin: ["/admin/voice-runtime"],
         )
         self.assertEqual([leg.name for leg in legs][1:], ["runtime", "topology"])
         for leg in legs[1:]:
             samples = int(leg.argv[leg.argv.index("--samples") + 1])
             interval = float(leg.argv[leg.argv.index("--interval-seconds") + 1])
-            self.assertGreaterEqual(samples * interval, 3_000.0)
+            self.assertGreaterEqual((samples - 1) * interval, 3_120.0)
 
 
 class WindowExecutionTest(unittest.TestCase):
@@ -256,6 +426,31 @@ class ReportTest(unittest.TestCase):
         self.assertTrue(closed["gate_closed"])
         self.assertFalse(open_gate["gate_closed"])
 
+    def test_production_process_exit_is_bound_to_checker_and_closed_gate(self) -> None:
+        closed = MODULE.summarize(
+            self._results(), rehearse=False, checker_returncode=0
+        )
+        checker_failed = MODULE.summarize(
+            self._results(), rehearse=False, checker_returncode=1
+        )
+        leg_failed = MODULE.summarize(
+            self._results((0, 1, 0)), rehearse=False, checker_returncode=0
+        )
+        self.assertEqual(0, MODULE.process_exit_code(closed))
+        self.assertEqual(1, MODULE.process_exit_code(checker_failed))
+        self.assertEqual(1, MODULE.process_exit_code(leg_failed))
+
+    def test_rehearse_exit_reports_leg_health_but_never_closes_gate(self) -> None:
+        passed = MODULE.summarize(
+            self._results(), rehearse=True, checker_returncode=None
+        )
+        failed = MODULE.summarize(
+            self._results((0, 1, 0)), rehearse=True, checker_returncode=None
+        )
+        self.assertEqual(0, MODULE.process_exit_code(passed))
+        self.assertEqual(1, MODULE.process_exit_code(failed))
+        self.assertFalse(passed["gate_closed"])
+
     def test_failed_leg_is_reported(self) -> None:
         report = MODULE.summarize(
             self._results((0, 1, 0)), rehearse=False, checker_returncode=None
diff --git a/scripts/test_start_public_runtime_contract.py b/scripts/test_start_public_runtime_contract.py
new file mode 100644
index 0000000..5e3862d
--- /dev/null
+++ b/scripts/test_start_public_runtime_contract.py
@@ -0,0 +1,331 @@
+from __future__ import annotations
+
+import unittest
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+
+SCRIPTS = Path(__file__).resolve().parent
+PUBLIC_RUNTIME = (SCRIPTS / "start-public-runtime.ps1").read_text(encoding="utf-8")
+WHISPER_START = (SCRIPTS / "start-local-whisper-stt.ps1").read_text(
+    encoding="utf-8"
+)
+
+
+class PublicRuntimeVoiceContractTest(unittest.TestCase):
+    def test_public_provider_model_and_loopback_environment_are_explicit(self) -> None:
+        for expected in (
+            '$WhisperModel = "small"',
+            '$WhisperDevice = "cpu"',
+            '$MeloTtsModel = "melotts-korean"',
+            '$env:VIGNETTE_VOICE_STT_PROVIDER = "local_whisper"',
+            '$env:VIGNETTE_LOCAL_WHISPER_STT_MODEL = $WhisperModel',
+            '$env:VIGNETTE_VOICE_TTS_PROVIDER = "melotts"',
+            '"ws://127.0.0.1:$WhisperPort/v1/listen"',
+            '"http://127.0.0.1:$MeloTtsPort"',
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, PUBLIC_RUNTIME)
+
+    def test_existing_listeners_require_exact_protocol_metadata(self) -> None:
+        self.assertIn('Test-VoiceSidecarReady -Component "stt"', PUBLIC_RUNTIME)
+        self.assertIn('Test-VoiceSidecarReady -Component "tts"', PUBLIC_RUNTIME)
+        self.assertIn("if (Test-PortListener -Port $WhisperPort)", PUBLIC_RUNTIME)
+        self.assertIn("if (Test-PortListener -Port $MeloTtsPort)", PUBLIC_RUNTIME)
+        self.assertIn("does not expose the exact local_whisper", PUBLIC_RUNTIME)
+        self.assertIn("does not expose the exact melotts", PUBLIC_RUNTIME)
+
+    def test_sidecar_fail_closed_gate_precedes_api_mutation(self) -> None:
+        sidecar_gate = PUBLIC_RUNTIME.index(
+            '# 두 sidecar를 한 번 더 함께 검사해 개별 probe 사이의 TOCTOU를 닫는다.'
+        )
+        api_stop = PUBLIC_RUNTIME.index("$apiStoppedProcessIds = @(")
+        self.assertLess(sidecar_gate, api_stop)
+        self.assertLess(
+            PUBLIC_RUNTIME.index("Voice sidecar readiness changed"),
+            api_stop,
+        )
+
+    def test_api_skip_and_post_start_checks_require_exact_voice_health(self) -> None:
+        for expected in (
+            '$Health.stt_provider -eq "local_whisper"',
+            "$Health.stt_model -eq $WhisperModel",
+            '$Health.tts_provider -eq "melotts"',
+            "$Health.tts_model -eq $MeloTtsModel",
+            "$Health.limits.uvicorn_ws_max_queue -eq 4",
+            "$health.engine -eq $true",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, PUBLIC_RUNTIME)
+        self.assertGreaterEqual(
+            PUBLIC_RUNTIME.count("Test-VoiceApiReady -Health"),
+            3,
+        )
+
+    def test_api_uvicorn_websocket_queue_is_pinned(self) -> None:
+        start = PUBLIC_RUNTIME.index("$apiStoppedProcessIds = @(")
+        end = PUBLIC_RUNTIME.index("Start-Sleep -Seconds 3", start)
+        api_section = PUBLIC_RUNTIME[start:end]
+        self.assertIn('"app.main:app"', api_section)
+        self.assertIn('"--ws", "websockets"', api_section)
+        self.assertIn('"--ws-max-queue", "4"', api_section)
+
+    def test_standalone_whisper_launcher_matches_public_cpu_default(self) -> None:
+        self.assertIn("[string]$Model = 'small'", WHISPER_START)
+        self.assertIn("[string]$Device = 'cpu'", WHISPER_START)
+
+
+class FreshPublicProvenanceContractTest(unittest.TestCase):
+    def test_fresh_mode_is_explicit_and_fail_closed(self) -> None:
+        for expected in (
+            "[switch]$RequireFreshPublicProvenance",
+            'throw "-RequireFreshPublicProvenance requires -ForceApiRestart"',
+            'throw "-RequireFreshPublicProvenance forbids -SkipCloudflaredRestart"',
+            "ExpectedSourceCommit",
+            "ExpectedSourceTree",
+            "ExpectedPythonSha256",
+            "ExpectedCloudflaredSha256",
+            "ExpectedCloudflaredConfigSha256",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, PUBLIC_RUNTIME)
+
+    def test_fresh_gate_precedes_every_runtime_mutation(self) -> None:
+        gate = PUBLIC_RUNTIME.index("Assert-FreshPublicProvenanceContract `")
+        receipt_preflight = PUBLIC_RUNTIME.index(
+            "$resolvedRuntimeProvenancePath = Initialize-RuntimeProvenanceOutput"
+        )
+        exact_ingress = PUBLIC_RUNTIME.index("-RequireUnchanged", gate)
+        engine_probe = PUBLIC_RUNTIME.index("$engineHealth = Get-JsonHealth")
+        self.assertLess(gate, receipt_preflight)
+        self.assertLess(receipt_preflight, exact_ingress)
+        self.assertLess(gate, exact_ingress)
+        self.assertLess(exact_ingress, engine_probe)
+        self.assertIn("requires detached HEAD", PUBLIC_RUNTIME)
+        self.assertIn("requires a clean stable source", PUBLIC_RUNTIME)
+
+    def test_receipt_preflight_proves_sibling_atomic_replace_capability(self) -> None:
+        preflight = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function Initialize-RuntimeProvenanceOutput") :
+            PUBLIC_RUNTIME.index("function Write-Utf8TextAtomically")
+        ]
+        for expected in (
+            "output preflight failed before runtime mutation",
+            "[System.IO.FileMode]::Open",
+            "[System.IO.FileAccess]::ReadWrite",
+            "[System.IO.File]::Replace($probeSource, $probeTarget, $probeBackup)",
+            "[System.IO.File]::Delete($probeTarget)",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, preflight)
+
+    def test_receipt_commit_is_atomic_and_failure_is_explicit(self) -> None:
+        writer = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function Write-Utf8TextAtomically") :
+            PUBLIC_RUNTIME.index("function Assert-FreshPublicProvenanceContract")
+        ]
+        for expected in (
+            "[System.IO.FileMode]::CreateNew",
+            "$stream.Flush($true)",
+            "[System.IO.File]::Replace($temporaryPath, $OutputPath, $backupPath)",
+            "[System.IO.File]::Move($temporaryPath, $OutputPath)",
+            "[System.IO.File]::Delete($temporaryPath)",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, writer)
+
+        receipt = PUBLIC_RUNTIME[PUBLIC_RUNTIME.index("$provenance = [ordered]@{") :]
+        self.assertIn("Write-Utf8TextAtomically `", receipt)
+        self.assertIn("no atomic passed receipt was published", receipt)
+        self.assertNotIn(
+            "[System.IO.File]::WriteAllText(\n    $resolvedRuntimeProvenancePath",
+            receipt,
+        )
+
+    def test_receipt_helpers_work_in_windows_powershell(self) -> None:
+        powershell = shutil.which("powershell.exe")
+        if powershell is None:
+            self.skipTest("Windows PowerShell 5.1 is not available")
+
+        function_source = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function Initialize-RuntimeProvenanceOutput") :
+            PUBLIC_RUNTIME.index("function Assert-FreshPublicProvenanceContract")
+        ]
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            root = Path(temporary_directory)
+            functions_path = root / "receipt-functions.ps1"
+            harness_path = root / "receipt-harness.ps1"
+            functions_path.write_text(function_source, encoding="utf-8-sig")
+            quoted_functions = str(functions_path).replace("'", "''")
+            quoted_root = str(root).replace("'", "''")
+            harness_path.write_text(
+                f"""$ErrorActionPreference = 'Stop'
+. '{quoted_functions}'
+$target = Join-Path '{quoted_root}' 'nested\\receipt.json'
+$resolved = Initialize-RuntimeProvenanceOutput -OutputPath $target
+Write-Utf8TextAtomically -OutputPath $resolved -Value '{{"status":"passed"}}'
+$receipt = Get-Content -LiteralPath $resolved -Raw -Encoding UTF8 | ConvertFrom-Json
+if ($receipt.status -ne 'passed') {{ throw 'atomic receipt content mismatch' }}
+Write-Utf8TextAtomically -OutputPath $resolved -Value '{{"status":"replaced"}}'
+$replacement = Get-Content -LiteralPath $resolved -Raw -Encoding UTF8 | ConvertFrom-Json
+if ($replacement.status -ne 'replaced') {{ throw 'atomic replacement mismatch' }}
+if (@(Get-ChildItem -LiteralPath (Split-Path -Parent $resolved) -Filter '*.tmp').Count -ne 0) {{
+  throw 'temporary receipt files were not cleaned'
+}}
+[System.IO.File]::SetAttributes($resolved, [System.IO.FileAttributes]::ReadOnly)
+$preflightFailed = $false
+try {{
+  Initialize-RuntimeProvenanceOutput -OutputPath $resolved | Out-Null
+}} catch {{
+  $preflightFailed = $true
+}} finally {{
+  [System.IO.File]::SetAttributes($resolved, [System.IO.FileAttributes]::Normal)
+}}
+if (-not $preflightFailed) {{ throw 'read-only receipt preflight did not fail' }}
+$preserved = Get-Content -LiteralPath $resolved -Raw -Encoding UTF8 | ConvertFrom-Json
+if ($preserved.status -ne 'replaced') {{ throw 'failed preflight changed the prior receipt' }}
+""",
+                encoding="utf-8-sig",
+            )
+            completed = subprocess.run(
+                [
+                    powershell,
+                    "-NoLogo",
+                    "-NoProfile",
+                    "-NonInteractive",
+                    "-ExecutionPolicy",
+                    "Bypass",
+                    "-File",
+                    str(harness_path),
+                ],
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                timeout=30,
+                check=False,
+            )
+            self.assertEqual(
+                completed.returncode,
+                0,
+                msg=f"stdout={completed.stdout}\nstderr={completed.stderr}",
+            )
+
+    def test_force_api_restart_keeps_regular_healthy_semantics(self) -> None:
+        self.assertIn(
+            "if ($apiControlPlaneReady -and -not $ForceApiRestart)",
+            PUBLIC_RUNTIME,
+        )
+        fresh_guard = PUBLIC_RUNTIME.index(
+            'throw "-RequireFreshPublicProvenance requires -ForceApiRestart"'
+        )
+        api_skip = PUBLIC_RUNTIME.index(
+            "if ($apiControlPlaneReady -and -not $ForceApiRestart)"
+        )
+        self.assertLess(fresh_guard, api_skip)
+
+    def test_api_and_tunnel_are_bounded_replacements_with_exact_cwds(self) -> None:
+        api = PUBLIC_RUNTIME.index("$apiStoppedProcessIds = @(")
+        cloud = PUBLIC_RUNTIME.index("$cloudflaredStoppedProcessIds = @(")
+        receipt = PUBLIC_RUNTIME.index("$provenance = [ordered]@{")
+        api_section = PUBLIC_RUNTIME[api:cloud]
+        cloud_section = PUBLIC_RUNTIME[cloud:receipt]
+        self.assertIn("Stop-UvicornByPort `", api_section)
+        self.assertIn("-TimeoutSec $ProcessStopTimeoutSeconds", api_section)
+        self.assertIn("-WorkingDirectory $ApiDir", api_section)
+        self.assertIn("did not receive a replacement PID", api_section)
+        self.assertIn("Stop-ProcessesBounded `", cloud_section)
+        self.assertIn("-TimeoutSec $ProcessStopTimeoutSeconds", cloud_section)
+        self.assertIn("-WorkingDirectory $Workspace", cloud_section)
+        self.assertIn("Cloudflared did not receive a replacement PID", cloud_section)
+        self.assertNotIn("Cloudflared already running; skipping", PUBLIC_RUNTIME)
+
+    def test_tunnel_command_and_config_are_pinned_before_receipt(self) -> None:
+        for expected in (
+            '"tunnel", "--config", $resolvedCloudflaredConfig, "run"',
+            "command line is not pinned to the expected config",
+            "Pinned cloudflared config drifted before provenance receipt",
+            "finalConfigSha256",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, PUBLIC_RUNTIME)
+
+    def test_fresh_tunnel_stop_matches_only_the_resolved_full_config_path(self) -> None:
+        cloud = PUBLIC_RUNTIME.index("$resolvedCloudflaredConfig =")
+        start = PUBLIC_RUNTIME.index(
+            "$cloudflaredProcess = Start-Process", cloud
+        )
+        cloud_section = PUBLIC_RUNTIME[cloud:start]
+        self.assertIn("if ($RequireFreshPublicProvenance)", cloud_section)
+        self.assertIn("-ConfigPath $resolvedCloudflaredConfig `", cloud_section)
+        self.assertIn("-ExactPath", cloud_section)
+        matcher = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function Get-CloudflaredProcessesForConfig") :
+            PUBLIC_RUNTIME.index("function Wait-ProcessIdentity")
+        ]
+        self.assertIn("-not $ExactPath", matcher)
+        self.assertIn("IndexOf($ConfigPath", matcher)
+
+    def test_receipt_projects_no_raw_command_or_config_contents(self) -> None:
+        projection = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function ConvertTo-SafeProcessIdentity") :
+            PUBLIC_RUNTIME.index("function Stop-NodeByPortHint")
+        ]
+        self.assertIn("command_line_sha256 =", projection)
+        self.assertNotIn("command_line =", projection)
+        self.assertNotIn("executable_path =", projection)
+
+        receipt = PUBLIC_RUNTIME.index("$provenance = [ordered]@{")
+        receipt_section = PUBLIC_RUNTIME[receipt:]
+        self.assertIn("api = $safeApiIdentity", receipt_section)
+        self.assertIn("cloudflared = $safeCloudflaredIdentity", receipt_section)
+        self.assertNotIn("api = $apiFinalIdentity", receipt_section)
+        self.assertNotIn("cloudflared = $cloudflaredFinalIdentity", receipt_section)
+        config_projection = receipt_section[
+            receipt_section.index("config = [ordered]@{") :
+            receipt_section.index("replacement = [ordered]@{")
+        ].lower()
+        self.assertNotIn("token", config_projection)
+        self.assertNotIn("credential", config_projection)
+        self.assertNotIn("contents", config_projection)
+
+    def test_process_start_and_command_hash_match_topology_psutil_algorithm(self) -> None:
+        identity = PUBLIC_RUNTIME[
+            PUBLIC_RUNTIME.index("function Wait-ProcessIdentity") :
+            PUBLIC_RUNTIME.index("function ConvertTo-SafeProcessIdentity")
+        ]
+        self.assertIn("datetime.fromtimestamp(p.create_time(), UTC)", identity)
+        self.assertIn("chr(0).join(p.cmdline())", identity)
+        self.assertIn("command_line_sha256 = $commandLineSha256", identity)
+
+    def test_receipt_is_direct_input_for_windows_topology_capture(self) -> None:
+        receipt = PUBLIC_RUNTIME.index(
+            'schema_version = "vignette.public-runtime-launch-provenance.v1"'
+        )
+        receipt_section = PUBLIC_RUNTIME[receipt:]
+        for expected in (
+            "git_commit = $ExpectedSourceCommit.ToLowerInvariant()",
+            "git_tree = $ExpectedSourceTree.ToLowerInvariant()",
+            "api_stopped_pids",
+            "cloudflared_stopped_pids",
+            "api_new_pid",
+            "cloudflared_new_pid",
+            "started_at_utc",
+            "executable_sha256",
+            "command_line_sha256",
+            "api_pid",
+            "api_executable_name",
+            "api_cwd",
+            "cloudflared_pid",
+            "cloudflared_executable_name",
+            "cloudflared_cwd",
+            "psutil_version",
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, receipt_section)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/watch-public-runtime-hidden.vbs b/scripts/watch-public-runtime-hidden.vbs
index 4207cf3..eecca18 100644
--- a/scripts/watch-public-runtime-hidden.vbs
+++ b/scripts/watch-public-runtime-hidden.vbs
@@ -1,3 +1,36 @@
+Option Explicit
+
+If WScript.Arguments.Count > 0 Then
+  If LCase(WScript.Arguments(0)) = "syntax-only" Then
+    WScript.Quit 0
+  End If
+End If
+
+Dim objShell
+Dim command
+Dim exitCode
+
 Set objShell = CreateObject("WScript.Shell")
-cmd = "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""D:\workspace\vignette\scripts\watch-public-runtime.ps1"" -Workspace ""D:\workspace\vignette"""
-objShell.Run cmd, 0, True
+command = "$ErrorActionPreference='Stop';" & _
+  "$task=Get-ScheduledTask -TaskName 'VignettePublicRuntimeWatchdog' -ErrorAction Stop;" & _
+  "$action=@($task.Actions)[0];" & _
+  "if([IO.Path]::GetFileName($action.Execute) -ne 'powershell.exe'){throw 'Pinned watchdog task must execute powershell.exe'};" & _
+  "$root=$action.WorkingDirectory;if([string]::IsNullOrWhiteSpace($root)){throw 'Pinned watchdog working directory is missing'};" & _
+  "$quote=[char]34;$expectedScript=Join-Path $root 'scripts\watch-public-runtime.ps1';" & _
+  "$expectedFileArg='-File '+$quote+$expectedScript+$quote;$expectedRootArg='-StableSourceRoot '+$quote+$root+$quote;" & _
+  "if($action.Arguments.IndexOf($expectedFileArg,[StringComparison]::OrdinalIgnoreCase) -lt 0){throw 'Pinned watchdog script path does not match its working directory'};" & _
+  "if($action.Arguments.IndexOf($expectedRootArg,[StringComparison]::OrdinalIgnoreCase) -lt 0){throw 'Pinned watchdog source root does not match its working directory'};" & _
+  "$required=@('-StableSourceRoot','-ExpectedSourceCommit','-ExpectedSourceTree','-ExpectedWatchdogSha256','-ExpectedStartScriptSha256');" & _
+  "foreach($marker in $required){if($action.Arguments.IndexOf($marker,[StringComparison]::Ordinal) -lt 0){throw ('Unpinned watchdog task action: missing '+$marker)}};" & _
+  "if($action.Arguments -match '(?i)(?:^|\s)-Workspace(?:\s|$)'){throw 'Legacy shared-worktree watchdog action is forbidden'};" & _
+  "Start-ScheduledTask -TaskName 'VignettePublicRuntimeWatchdog'"
+command = "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command """ & _
+  Replace(command, """", """""") & """"
+If WScript.Arguments.Count > 0 Then
+  If LCase(WScript.Arguments(0)) = "print-command" Then
+    WScript.Echo command
+    WScript.Quit 0
+  End If
+End If
+exitCode = objShell.Run(command, 0, True)
+WScript.Quit exitCode
diff --git a/scripts/watch-public-runtime.ps1 b/scripts/watch-public-runtime.ps1
index 230b713..bd6fe96 100644
--- a/scripts/watch-public-runtime.ps1
+++ b/scripts/watch-public-runtime.ps1
@@ -1,5 +1,18 @@
 param(
-  [string]$Workspace = "D:\workspace\vignette",
+  [Parameter(Mandatory = $true)]
+  [string]$StableSourceRoot,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{40}$")]
+  [string]$ExpectedSourceCommit,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{40}$")]
+  [string]$ExpectedSourceTree,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{64}$")]
+  [string]$ExpectedWatchdogSha256,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-fA-F]{64}$")]
+  [string]$ExpectedStartScriptSha256,
   [int]$ApiPort = 8001,
   [int]$WebPort = 5174,
   [int]$EnginePort = 9099,
@@ -20,12 +33,97 @@
 
 $ErrorActionPreference = "Stop"
 
+$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
+$expectedWatchdogPath = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime.ps1"
+$startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
+
+function Invoke-GitText {
+  param([string[]]$Arguments)
+
+  $value = & git.exe -C $resolvedSourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
+}
+
+function Assert-StableSourceProvenance {
+  if (-not (Test-Path -LiteralPath $expectedWatchdogPath -PathType Leaf)) {
+    throw "Pinned watchdog script not found at $expectedWatchdogPath"
+  }
+  if (-not (Test-Path -LiteralPath $startScript -PathType Leaf)) {
+    throw "Pinned start script not found at $startScript"
+  }
+
+  $runningWatchdogPath = (Resolve-Path -LiteralPath $PSCommandPath).Path
+  if (-not [string]::Equals(
+      $runningWatchdogPath,
+      (Resolve-Path -LiteralPath $expectedWatchdogPath).Path,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Watchdog is not executing from the pinned stable source root"
+  }
+
+  $gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
+  $resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+  if (-not [string]::Equals(
+      $resolvedGitRoot,
+      $resolvedSourceRoot,
+      [System.StringComparison]::OrdinalIgnoreCase
+  )) {
+    throw "Stable source root does not match its Git toplevel"
+  }
+
+  $symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+  $symbolicHeadExit = $LASTEXITCODE
+  if ($symbolicHeadExit -eq 0) {
+    throw "Stable source must be a detached HEAD, not branch $symbolicHead"
+  }
+  if ($symbolicHeadExit -ne 1) {
+    throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+  }
+
+  $actualCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
+  $actualTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+  if ($actualCommit -ne $ExpectedSourceCommit.ToLowerInvariant()) {
+    throw "Stable source commit drift: expected=$ExpectedSourceCommit actual=$actualCommit"
+  }
+  if ($actualTree -ne $ExpectedSourceTree.ToLowerInvariant()) {
+    throw "Stable source tree drift: expected=$ExpectedSourceTree actual=$actualTree"
+  }
+
+  $dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+  if ($dirty) {
+    throw "Stable source is not clean; refusing runtime recovery"
+  }
+
+  foreach ($relativePath in @(
+    "scripts/watch-public-runtime.ps1",
+    "scripts/start-public-runtime.ps1"
+  )) {
+    Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
+  }
+
+  $actualWatchdogSha256 = (Get-FileHash -LiteralPath $expectedWatchdogPath -Algorithm SHA256).Hash.ToLowerInvariant()
+  $actualStartScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+  if ($actualWatchdogSha256 -ne $ExpectedWatchdogSha256.ToLowerInvariant()) {
+    throw "Pinned watchdog SHA256 drift"
+  }
+  if ($actualStartScriptSha256 -ne $ExpectedStartScriptSha256.ToLowerInvariant()) {
+    throw "Pinned start script SHA256 drift"
+  }
+}
+
+# health probe, failcount 기록, 프로세스 재기동보다 먼저 source provenance를 닫는다.
+# 검증 실패는 운영 프로세스를 그대로 보존한 채 non-zero로 끝난다.
+Assert-StableSourceProvenance
+
 if (!$LogPath) {
-  $LogPath = Join-Path $Workspace "public-runtime-watchdog.log"
+  $LogPath = Join-Path $resolvedSourceRoot "public-runtime-watchdog.log"
 }
 
 # 연속 실패 카운터(재시작 debounce용). 워치독은 매 실행마다 새 프로세스라 파일로 유지한다.
-$FailCountPath = Join-Path $Workspace "public-runtime-watchdog.failcount"
+$FailCountPath = Join-Path $resolvedSourceRoot "public-runtime-watchdog.failcount"
 
 function Get-FailCount {
   if (Test-Path $FailCountPath) {
@@ -130,11 +228,6 @@ function Test-CloudflaredProcess {
   }
 }
 
-$startScript = Join-Path $PSScriptRoot "start-public-runtime.ps1"
-if (!(Test-Path $startScript)) {
-  throw "Start script not found at $startScript"
-}
-
 # engine 판정은 /health(프로세스 liveness)가 아니라 /ready(실제 claude -p 생성)로 한다.
 # /health는 ok:true만 보므로 "프로세스는 살아 있고 그 프로세스의 claude 세션만 죽은"
 # 상태를 통과시킨다(2026-08-07 공개 런타임: engine=false인데 워치독 lastResult=0).
@@ -197,7 +290,7 @@ if ($failCount -lt $FailuresBeforeRestart) {
 }
 
 $startArgs = @{
-  Workspace = $Workspace
+  Workspace = $resolvedSourceRoot
   ApiPort = $ApiPort
   WebPort = $WebPort
   EnginePort = $EnginePort