ACCEPT WITH FIXES

## Finding verdicts

1. **ADDRESSED — Ratchet read errors fail closed.** `internal/release/ratchet.go:118` now distinguishes absence from read errors and invalid file types; `Admit` refuses unknown state at line 100. Fresh-instance tests cover unreadable `own` and `also` directories at `internal/release/ratchet_test.go:212`.

2. **ADDRESSED — Resign requires channel authority.** `internal/console/apidigests.go:121` checks deploy scope, stable, pipeline passkey and approval requirements. The authorization runs inside `WithAppMutation` through `internal/release/claim_app_writes.go:59` and `internal/release/resign.go:107`. The legacy-head substitution regression is covered at `internal/console/apidigests_test.go:300`.

3. **ADDRESSED — History-target refusals survive marker removal.** The checks at `internal/release/release.go:810` and `:1273` no longer require the marker. Emission remains marker-dependent. Ordinary and approval-path rollback tests appear at `internal/release/writers_test.go:390` and `:405`.

4. **ADDRESSED — Incomplete reports cannot announce readiness.** Failed channel reads produce explicit errors at `internal/release/digests.go:183`. Both consumers propagate them into account errors (`internal/console/apidigests.go:243`, `channels_digests.go:312`), suppressing readiness through `channels_digests.go:235`.

5. **ADDRESSED — Ratchet paths no longer collide.** `internal/release/ratchet.go:77` encodes each channel into one flat filename. Regular-file checks appear at lines 133 and 160. Both collision orders and restart behavior are covered at `internal/release/ratchet_test.go:159`.

6. **NOT ADDRESSED — Production integration coverage remains incomplete (Minor).** Replay and require-flag coverage now uses `fastPassOpts` and the production-configured static handler (`internal/host/pointerdigests_test.go:151`, `internal/edge/staticdigest_test.go:153`). However:
   - Failed-persistence coverage still constructs options manually at `internal/host/pointerdigests_test.go:60`.
   - The new static-handler tests at `internal/edge/staticdigest_test.go:241` and `:281` never exercise failed persistence.
   - The host replay test at `internal/host/pointerdigests_test.go:165` checks the live version, without substituting bytes or asserting that staging never occurred.

   Complete those cases through the existing production test fixtures, including assertions that refusal prevents staging/extraction and that a later digestless replay remains refused.

7. **ADDRESSED — Draft-dependent assertions removed.** `channels_digests_test.go:117` derives the header from its constant; lines 343 and 357 derive status expectations from constants and actual timestamp/error values. The unsafe literal-length slice is gone.

8. **ADDRESSED — Existing responses are shared.** `internal/console/apicli.go:1222` and `:1243` centralize the shipped responses, reused by the digest handlers. The moved wording is outside this review.

## New breakage

No new Critical or Important breakage found in `bb343ec3..d04e7634`.

`git diff --check` passes. Tests and builds were not rerun because they create files; the fix report’s execution results remain independently unverified. No files changed.

## Out-of-scope observations

Non-blocking: the documented stable-resign example now requires the direct-store operator path. The controller explicitly accepted that restriction; documentation reconciliation remains with the pending copy review.