Product freeze e078ba23b543126011a2136dd1f7e98ca65370eb, tree 8dcb202703044ca733c03fe23b56c2f25a3f2236, SOURCE_DATE_EPOCH 1792100410. This replaces the vulnerable rustls0.23.45 candidate for future acceptance; all historical8fb artifacts/results remain immutable. This record establishes construction/reproducibility and exact inspection only, not native installation, browser, soak or deployment acceptance. No release/tag was published.

Independent consoleA/B distributions matched (diff -ru exit0); independent DEBA/B matched (cmp exit0), and separate RPM metadata executions from canonicalDEBA matched (cmp exit0). Source bundle bytes matched; source manifest bytes include side-specific paths and were validated by the registered equality fields rather than incorrectly asserted byte-identical.

Canonical DEB directory DATA/results/installation-package-build/replacement-tls-01-deb-a; RPM DATA/results/packages/replacement-tls-01-rpm-a; prepared source commit 28bcdf7ac833ab634d3b130b85cb2a0aa47eb7a8. The common inspected payload has626 files, including12 console files. Full inspection /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/package-inspection.json, SHA256 46c7e53ac698a34cebb4f85f84eca460f131aec2ce6a419cfb23b71092ef5d4b.

Every following outer receipt exited0 and confirms stopped descendants. The recorded command ran through its pinned run-stepA/B driver and required resource launcher. Exact command/output/log/containment hashes are retained in the corresponding <label>.json under /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01.

• replacement-tls-01-ui-tools: resourceSHA cbeb6e3da4ecfd913da1ec179c652531ee94e7637a8d4dc5604ca437452506fe.

python3 -B tools/ci/install-ui-tools.py

• replacement-tls-01-cargo-fetch: resourceSHA 58b3dbfe95a4fe0aec05d2d93722cc8cdaddf208303ed4637ce7d17dbbab2645.

cargo +1.99.0 fetch --locked

• replacement-tls-01-console-a: resourceSHA 61ef8de4a159a74de9a1ee4752bc492391d292f79170aab1394730aac6113452.

env SOURCE_DATE_EPOCH=1792100410 CARGO_TARGET_DIR=/run/media/kmosoti/data/FabricO11y/scratch/console-target-replacement-tls-01-a python3 -B tools/ui/build.py --out /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-a

• replacement-tls-01-console-b: resourceSHA 7fff514274eba4965243b43c0d76d45f1e2eef01b82bf6bb82862aa54c230343.

env SOURCE_DATE_EPOCH=1792100410 CARGO_TARGET_DIR=/run/media/kmosoti/data/FabricO11y/scratch/console-target-replacement-tls-01-b python3 -B tools/ui/build.py --out /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-b

• replacement-tls-01-console-diff: resourceSHA 3f4ccb0ed2c447e857754f77351cae93dd83ef4dbadcd622a3bdce2f66b39dc1.

diff -ru /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-a/dist /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-b/dist

• replacement-tls-01-console-target-hardlink-controls-01: resourceSHA 58fe8cca55e62603a6f6c52cc043f7c1bd3dd80ec055e0c1127c97bd7260137c.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/cleanup-fresh-console-targets.py --hardlink-controls

• replacement-tls-01-console-marker-preparation-01: resourceSHA f48b026d773c745c93c369fc8cb5c529dfafd00afc4099d6ea0142e0f55ca5fe.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/prepare-console-markers.py

• replacement-tls-01-console-target-marker-controls-03: resourceSHA e3a2283fd12383c99280fb0caaae7de6121629eff2fba2e26ef488ec7ce164ec.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/negative-console-target-markers.py

• replacement-tls-01-console-target-dry-run-01: resourceSHA d1148af273e5585c480ec4a01f0f71f80fe1830a1d0590b30b61f5e5604b2538.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/cleanup-fresh-console-targets.py --inventory /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/fresh-console-targets-inventory.json

• replacement-tls-01-console-target-cleanup-01: resourceSHA 54f42ab12f26fda94ed7764ba08d98ef30126b5c6bd455ce9f81583c0ad3445e.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/cleanup-fresh-console-targets.py --inventory /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/fresh-console-targets-inventory.json --execute --expected-inventory-sha256 958e689da6b555321707b8248a120c753456d8eca1e5bdc43a88b37c481f071f

• replacement-tls-01-deb-a: resourceSHA eea67493de59ba8d5401b333ef0e44dc6973a2d93ed4998570e31d87d5b23295.

env SOURCE_DATE_EPOCH=1792100410 python3 -B tools/qualification/install/build-isolated.py --family debian --run-id replacement-tls-01-deb-a --console-build /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-a

• replacement-tls-01-deb-b: resourceSHA eb577fccede847cf516cd5925d4b09205a03d86b3a5e31fe074462d8a29af646.

env SOURCE_DATE_EPOCH=1792100410 python3 -B tools/qualification/install/build-isolated.py --family debian --run-id replacement-tls-01-deb-b --console-build /run/media/kmosoti/data/FabricO11y/results/console-replacement-tls-01-b

• replacement-tls-01-deb-image-negative-01: resourceSHA fb6576d502ec6d7a236bbdc4e5f717097cfd252c24e7bffb047c0ebbfae771a7.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/guard-deb-reproducibility.py --negative-control

• replacement-tls-01-deb-compare-01: resourceSHA bd1dfa4a6280853b936f24ad7205eb51e487e046417fb207e78d4adc10996a55.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/guard-deb-reproducibility.py

• replacement-tls-01-rpm-a: resourceSHA 1b2f78717004da64bec699455dbc1bc455708c9a0ca248781ef797b370c7c240.

python3 -B tools/packaging/build_candidate_rpm.py --deb-receipt /run/media/kmosoti/data/FabricO11y/results/installation-package-build/replacement-tls-01-deb-a/receipt.json --out /run/media/kmosoti/data/FabricO11y/results/packages/replacement-tls-01-rpm-a

• replacement-tls-01-rpm-b: resourceSHA dd8c17b40039487e8b9aac0fcf680043cda157a4437067b161f078f4c15819ed.

python3 -B tools/packaging/build_candidate_rpm.py --deb-receipt /run/media/kmosoti/data/FabricO11y/results/installation-package-build/replacement-tls-01-deb-a/receipt.json --out /run/media/kmosoti/data/FabricO11y/results/packages/replacement-tls-01-rpm-b

• replacement-tls-01-rpm-diff: resourceSHA 480e6f6646c18aa05ad5e166e2b08cdbfe85406876a82ef1dc678b84bb167209.

cmp /run/media/kmosoti/data/FabricO11y/results/packages/replacement-tls-01-rpm-a/fabrico11y-0.1.0-0.alpha.1.x86_64.rpm /run/media/kmosoti/data/FabricO11y/results/packages/replacement-tls-01-rpm-b/fabrico11y-0.1.0-0.alpha.1.x86_64.rpm

• replacement-tls-01-negative-console-binding-02: resourceSHA 60d505ad536d137122569c83291e81e8e4615a0ef828b22df707ba3c0a2d357f.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/negative-console-binding-02.py

• replacement-tls-01-package-inspect: resourceSHA e281895872ac7c17a03aa4b47bcd80341e6fa13950799eee4dbc597a1ad68356.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-replacement-tls-01/inspect-candidate.py package-inspection.json

Initial markercontrol02 failed1 before the intended operation because fresh console targets lacked the historical ownership markers. A separate constructor validated exact actual build/admission/asset/stop bindings and created exclusive0600/fsynced markers plus three one-field forgeries; unchanged refusal checks then exited0. Dryrun produced actual inventorySHA 958e689da6b555321707b8248a120c753456d8eca1e5bdc43a88b37c481f071f, posted before unchanged identity/inode/hardlink/marker-checked deletion; both owned console target directories were removed.

Initial consolebindingnegative01 failed1 before its intended refusal because the preparation made milestone branches while the unchanged inspector required detached constructor worktrees. Reversible git switch --detach e078ba23 retained branch refs and identical clean source bytes. Fresh negative02 observed the original exact b-matching-console-receipt mismatch with inspector2/wrapper0; original receipts were unchanged. These initial failures remain failures, not successful negative detections.

An earlier owner budget stop refused the next cell before project launch after both DEB builds; no receipt/pass was invented. The subsequent authorized continuation retained all successful builds and executed only the pending tail. Owner later removed the budget boundary; resource/storage/gates remain unchanged.

Builds used mounted DATA, strict full-namespace census, fresh per-command reservations and95GB stop. Default outer16/20GiB/noSwap1800s; isolated DEB inner7/8GiB/noSwap1500s, reserve8GiB perbuild. Both DEB receipts confirm container images/payload removal and absent host-owned scratch; launcher temporary cleanup and all outer stops were confirmed. Failed-run evidence remains retained. Product bytes are frozen independently from later harness merges. Fresh patched witness helper and actual acceptance remain required.