# End-to-End Ledger Integrity validation 25 October 2026. Local source/teaching package acceptance. Website snapshot/build acceptance is separately owned by the domain coordinator; this receipt does not claim remote deployment, encoded video, a real bank, live provider retention or a fresh PostgreSQL read. ## Independent expectations and actual implementations An independent author prescribed **61 complete reports before orchestrator code**, importing no End production implementation. All 61 agree completely with both actual Python and strict TypeScript, including every layer, reason, mismatch, proof, summary and 27-control inventory. The author separately checked **49 applicable cases against the real earlier child kernels**. The final core runner passes **15 Python methods**, strict TypeScript build, Node native-refusal checks, complete output parity and input/output detachment regressions. The independent malformed-JSON review covered **4260 cross-runtime cases** without an escaping exception or differing report; this broader audit is a separate coordinator-owned receipt. [Full core receipt](core-validation.json) · [complete parity/source hashes](parity-results.json) · [local pinned-source provenance](SOURCE-PINS.json). Final orchestrator SHA256: - Python: `9eeba277c90c8dfdcb537f2f0f268bd7f529e3d37f1c9559df7029f0bb28c784`. - TypeScript: `24b40776b74cc84f8951a5983532ff5c633dea4c490d93232f9358ac2e54925a`. ## Actual browser, controls and rendered pixels The standalone lab embeds the final actual bundled orchestrator with all locally pinned Fold/Hash/Merkle/Signed/Anchor modules and noble dependencies. No displayed expected result substitutes for execution. Chromium independently executed all **61 complete fixture reports** and matched each literal expectation. Across **16 guided scenario families** at **390, 768 and 1440px**, **498 meaningful layer/rejection observations** passed. **60 complete captured lab outputs** also match Python, including the trusted native-refusal adapter. A concurrent refusal/normal invocation regression verifies the temporary native provider cannot leak between cases. All eleven results and every one of the 27 earlier control IDs remain visible. The complete supplied group/journal table retains four journals/eight ordered legs in the original branch, including both correction members. The source and diagnostic tables are focusable horizontal regions on narrow screens. Strict root rejection fabricates no partial layer, balance or control report. The internal case has four direct/two historical/twenty not evaluated/one excluded; required anchoring has five direct/two historical/twenty not evaluated and remains overall indeterminate. Step/Back/Play/Pause/Reset, keyboard transport, scenario switching, actual age/policy parameters, asynchronous cancellation and reduced-motion single-step behavior passed. Interactive targets are at least 44px; document overflow and console warnings/errors are absent at all three widths. Age 60 seconds accepts equality; 59 seconds is stale for the canonical 60000ms claim. Actual native SHA256 refusal leaves Ed25519 and independently calculable freshness active, keeps missing digest null and cannot pass the whole policy. [Browser receipt](browser-qa/results.json) · [complete captured browser outputs](browser-reference-outputs.json) · [phone controls](browser-qa/lab-internal-390-top.png) · [phone layer table](browser-qa/lab-layers-390.png) · [phone source table](browser-qa/lab-source-390.png) · [Desktop required-policy view](browser-qa/lab-required-1440.png). Both purposeful native SVGs and the real Mermaid render were opened as browser pixels and inspected. Policy labels, all eleven rows, exact original amounts/signs, three groups/four journals and 5+2+20 inventory remain legible with no clipped labels or overlapping connectors. The article includes the static SVGs inline plus full-size links and a separate inline Mermaid flow. ## Actual retained-export integration, separately scoped The durability owner's actual canonical-kernel harness reobserves the hash-pinned retained export from the earlier disposable PostgreSQL close branch. It does not reconnect to PostgreSQL. Both the SQL-close and original correction branches run ten adversarial scenarios: **20 complete actual End reports match Python and TypeScript**. Results are 2 bounded internal-policy passes, 8 indeterminate and 10 known failures. Required live external evidence never passes. The Balance Proof kernel also reruns its retained actual-close normalized input and the independently wrong 90001 external closing counterexample. [Integration validation](archived-journey/VALIDATION.md) · [complete language parity](archived-journey/end-typescript-parity.json) · [source/child pins](archived-journey/journey-results.json) · [actual End diagnostics](archived-journey/end-status.json) · [archive observation](archived-journey/archive-observation.json). Complete supplied End input/Python/TS JSON for all 20 cases is copied in [the complete-case archive](archived-journey/complete-case-reports.json). The archive remains CB-CLOSE-2026/CB-A, cash 90000/head 5. The original branch remains CB-GENERAL/CB-A, Ada normal 97600/head 4. Baseline C 300/E 524 and envelope SHA256 `8c3d6bb3a098a957a5b555064cda453528aff09995a63a944fd902076f523972` match the independent before-core byte vectors. Separate local retained baseline copies establish test candidate/expectation separation, not independent external WORM authority. Currentness and trust receipts are explicit synthetic host facts; no physical COMMIT time is inferred. ## Reproduce and interpret the limits From the repository root: ```powershell python algorithms/domains/D30-banking-ledger-and-reconciliation/D30-F05-tamper-evident-ledger-integrity/D30-F05-A08-end-to-end-ledger-integrity-verification/tests/run_tests.py python algorithms/domains/D30-banking-ledger-and-reconciliation/D30-F05-tamper-evident-ledger-integrity/D30-F05-A08-end-to-end-ledger-integrity-verification/tests/build_lab.py node algorithms/domains/D30-banking-ledger-and-reconciliation/D30-F05-tamper-evident-ledger-integrity/D30-F05-A08-end-to-end-ledger-integrity-verification/tests/visual-qa.mjs python algorithms/domains/D30-banking-ledger-and-reconciliation/D30-F05-tamper-evident-ledger-integrity/D30-F05-A08-end-to-end-ledger-integrity-verification/tests/check_browser_outputs.py ``` Install the shipped exact [runtime dependencies](dependencies/README.md) first; package lock, observed wheel hashes and upstream licenses are supplied. Modules are locally pinned inside this package, so no sibling algorithm is imported at runtime. Public RFC seeds are demonstration fixtures. Python uses patched PyNaCl1.6.2/libsodium; TS uses noble2.4.0 strict-main-subgroup checks plus actual WebCrypto. Missing native primitives produce bounded uncertainty; unexpected programmer TypeError remains visible rather than being swallowed. [Exact field-level contract](data-contract.md) · [shared exact bytes](integrity-byte-contract.md) · [primary source roles](REFERENCES.md). Independent source authenticity, economic intent, recognition, non-equivocation, production custody, live retention, legal sufficiency and production control transitions remain outside this bounded verifier. Known failures survive missing layers; absence never becomes a pass.