# r02: explicit data binding and privacy repair

September 13, 2026. This repairs one existing unit's packaging preparation.
Frozen r01 and its receipts are unchanged. No research, source/aesthetic
re-review, media creation, publication, or completed-study increment occurred.

## Changed members

Line numbers refer to this r02 directory. The six original useful files remain;
this note is the seventh distributable file.

| Member | Changed r02 locations | Change |
| --- | --- | --- |
| `README.md` | 3,61,122,179,665 | r02 status; caller-supplied subset layout; observations explicitly inherited from r01; standalone commands and configuration precedence. |
| `handoff.py` | 169,177,302,311 | Remove machine-specific `DEFAULT_STAGE`; resolve explicit `--stage` before `FIELDNOTES_STAGE`; fail before source reads when neither is configured; CLI exits 2 with no verification JSON. |
| `bindings.json` | 4,436 | Keep accepted-stage name as a historical label, not a location; add the required argument/environment binding descriptor. Every source, archive, member, evidence and lineage SHA is unchanged. |
| `test_handoff.py` | 4,6,9,17,36,165,177 | Explicit configured stage in setup and retained evidence checks; retain all 15 mechanism tests; add four configuration tests. |
| `controls.json` | unchanged | Exact r01 bytes. |
| `renderer-check.mjs` | unchanged | Exact r01 bytes. |

Unchanged file SHA-256 values:

```text
controls.json
45ee77ffb5ef146c32ec6a4d1a94a8c1e6ec57969643aaf95e8354d8c26261f8
renderer-check.mjs
e1e587d6a437e92a7ff3fa665ac70403ec5357dbd838205437b91c80eb9975e2
```

## Executed checks

- **19 tests pass:** all 15 retained tests plus missing configuration before
  reads, missing `--stage` value, explicit-argument precedence, and environment
  fallback/empty-configuration rejection.
- Old and r02 `verify --probe` stdout are byte-identical against the supplied
  read-only stage: **650 cases, 26,650 layer rows, 746,200 numeric comparisons**.
  An explicit stage overrides an invalid environment binding; the valid
  environment-only command produces the same output.
- Default and adaptation `table --frames all` outputs are each byte-identical
  between revisions: **12,054 rows / 18,484,086 stdout bytes per variant**.
  These streams were compared in memory, not saved as large output files.
  A smooth curve and a hold-width expression also match byte-for-byte.
- r01 without configuration silently verified its local default. r02 without
  configuration exits 2, emits no stdout, and states that no verification was
  performed. Source/native/hash checks were not bypassed to obtain portability.

Deterministic old/new stdout SHA-256 values:

```text
verify --probe
556ccc46a292b5984c82b0bd0a767b6add86a4de96c941cdef72fdeb8514fc7e
table --variant default --frames all
e0e8c989986cda8198fd7dca5a29d7d4e87dde6ca13c75dc61423bb6c8e394a1
table --variant adaptation --frames all
3c6e2ef45a626f2e980e5f2ed71c86a73d35119f11f5320c078c52b0df9c1fa3
```

## Privacy and remaining gates

All seven distributable files receive the secret-scrubber `--summary-only`
check and manual flag review. The three r01 absolute-path leaks are removed.
No actual machine-local path remains. Expected flags are public SHA values,
public/relative archive paths, descriptive test identifiers, Python constants,
and documented environment placeholders; these are not credentials. Runtime
code and immutable model bytes are not blindly replaced with redaction tokens.
Literal execution logs, configuration locations, and freeze/accounting receipts
remain private and are not part of this directory's publication payload.

The two archive hashes and all 42 selected-member hashes still pass. Existing
manifest-wrapper discrepancies and absent ancillary `ASSET-NOTES.json` /
`FONT-LICENSE.txt` remain disclosed; shared rights/OFL files are present. Source
metadata lineage, 60 fps clocks, SVG assets, typing, attachment and departure
behavior are unchanged.

No minimal subset was assembled or fetched here; README describes the two
already-public archive paths and 12 retained-file paths required for one.
Native Resolve preparation/replay, fresh moving review, and publication remain
pending. The coordinator's full-workflow reservation remains blocked and was
not reduced or exercised. The independent r01 critic's findings were not sought
or read. This portability result is not that critic's verdict or approval to
publish r02.