Record fix-up receipts (download-back hash + fresh-venv smoke) in manifest, sums, changelog, acceptance

RELEASE-MANIFEST.json

@@ -77,7 +77,7 @@
     "blocked_on": [],
     "decisions": "destination repo id and publication revision approved by the owner on 2026-11-05",
     "destination": "huggingface.co/WayneRR/cognitive-learning-lab (model repo)",
-    "post_download_verification": "wheel+sdist re-downloaded from the published repo via hf-mirror (the file CDN behind huggingface.co times out on this network; hashes are endpoint-independent) and both SHA-256 match the uploaded build exactly: wheel 803ee8248669030d97fedc2d185af5ce5d0821711eb3a911b30e3857e9dce667, sdist 37375e949ab869cccd431342a87c1d6dc9db0af98c504e79538c89ad68cb4753. A fresh uv venv installed the downloaded-back wheel: doctor rc=0, infer rc=0 answered/mock/verified_judgment, second-process replay rc=0 answered with memory reuse.",
+    "post_download_verification": "performed twice, once per uploaded build. (1) Build 803ee824 (wheel) / 37375e94 (sdist), upload commit 4225068d: re-downloaded via hf-mirror, hashes matched byte-for-byte, fresh venv smoke passed. (2) Current build 64e02c1a (wheel) / d69ad3ce (sdist), upload commit 5ccf3666 (card fix-up: stale NOT_UPLOADED badge removed, YAML frontmatter added): re-downloaded via hf-mirror, hashes 64e02c1ab36023f4ae66c6da0d0ba6fba959bd88664d6b37590b3905c71f28e1 / d69ad3ce98d3a63fdf2519724675f599920b4173cf3a4a381bee00b6fc9b0213 match byte-for-byte, fresh uv venv installed the downloaded-back wheel: doctor rc=0, infer rc=0 answered/mock/verified_judgment, second-process replay rc=0 answered with memory reuse. The file CDN behind huggingface.co times out on this network, so downloads go through hf-mirror; hashes are endpoint-independent.",
     "publication_revision": "55cf4c4ebb4ebe31b2550e8bdf3bd21b99753851",
     "remote_commit": "4225068d5f589f1bea843cce313475ce197c3b79",
     "remote_commit_url": "https://huggingface.co/WayneRR/cognitive-learning-lab/commit/4225068d5f589f1bea843cce313475ce197c3b79",
@@ -86,14 +86,14 @@
     "uploaded_at_utc": "2026-11-05T09:20:00+00:00 (approx; single upload_folder commit)"
   },
   "release_bundle_files_sha256": {
-    "CHANGELOG.md": "de097210d06989e82d0cfc07f38d7acd486b1b2440b17d0142742a16185b11cb",
+    "CHANGELOG.md": "fbf19fa6b43d678f3a9280981a63c3e5aa32c1570b52f04923284c6c34b8ae71",
     "LICENSE": "d55f3052cc51ef8bb0fb0161b55f98d93cb7542c1c6b19e1ebf5655a8c1408a1",
     "MODEL_CARD.md": "50093c10d4c51f9cfa96d6bad44a3c9d3377ca96dc073d5e37fe5d2ba0d284e1",
     "PAPER-ARTIFACT-NOTE.md": "922482bb820725975e920a5367a13bec8413890b8cc8eedbb4c4e09f31dd1526",
     "README.md": "e60359ccd37cb59f7e29b5c61607af945bb161ebe25670c8f666e790c6a9ffe2",
     "SOURCE-INVENTORY.md": "9da97103cbd853534c6e5d9f866bc1608330c213ffad76d7d6d2ef6317edee82",
     "THIRD_PARTY_NOTICES.md": "4d4222fba571ec4621f22c6a199925375fbb3d43bbec774a8f800bea7417dbc4",
-    "acceptance/PR-M1.md": "a5135a6209bafa3cd71dee5fd90df5e8f4861d041b3272cab666b229707443db",
+    "acceptance/PR-M1.md": "441967ba1e407106cc12588de465b5b92560cf1de8980193b9c96cebbc6d1b02",
     "pyproject.toml": "bdedce510fda22aed93b9035cba67afa6f939785e4f78eab8b799f2109db0b4b",
     "requirements-lock.txt": "adb192fbfd6a98c79c5e59bb7345c8e2db66183d6494d25dd233b1bbcc8ad1f6"
   },

SHA256SUMS

@@ -1,11 +1,11 @@
-de097210d06989e82d0cfc07f38d7acd486b1b2440b17d0142742a16185b11cb  CHANGELOG.md
+fbf19fa6b43d678f3a9280981a63c3e5aa32c1570b52f04923284c6c34b8ae71  CHANGELOG.md
 d55f3052cc51ef8bb0fb0161b55f98d93cb7542c1c6b19e1ebf5655a8c1408a1  LICENSE
 50093c10d4c51f9cfa96d6bad44a3c9d3377ca96dc073d5e37fe5d2ba0d284e1  MODEL_CARD.md
 922482bb820725975e920a5367a13bec8413890b8cc8eedbb4c4e09f31dd1526  PAPER-ARTIFACT-NOTE.md
 e60359ccd37cb59f7e29b5c61607af945bb161ebe25670c8f666e790c6a9ffe2  README.md
 9da97103cbd853534c6e5d9f866bc1608330c213ffad76d7d6d2ef6317edee82  SOURCE-INVENTORY.md
 4d4222fba571ec4621f22c6a199925375fbb3d43bbec774a8f800bea7417dbc4  THIRD_PARTY_NOTICES.md
-a5135a6209bafa3cd71dee5fd90df5e8f4861d041b3272cab666b229707443db  acceptance/PR-M1.md
+441967ba1e407106cc12588de465b5b92560cf1de8980193b9c96cebbc6d1b02  acceptance/PR-M1.md
 bdedce510fda22aed93b9035cba67afa6f939785e4f78eab8b799f2109db0b4b  pyproject.toml
 adb192fbfd6a98c79c5e59bb7345c8e2db66183d6494d25dd233b1bbcc8ad1f6  requirements-lock.txt
 0e336eb9d215ee2c7c4b8366558dcf1792c33a3c3ad0126f44555fef4a6e10d3  src/cognitive_runtime/__init__.py

acceptance/PR-M1.md

@@ -490,3 +490,14 @@ tree, sdist mock infer rc=0, SHA256SUMS regenerated with zero integrity
 mismatches. The rebuilt artifacts replace `803ee824…` / `37375e94…` in the
 published repo; the download-back verification was repeated against the new
 build (receipt in `RELEASE-CHECKLIST.md` / `RELEASE-MANIFEST.json`).
+
+### Download-back receipt for the fix-up build
+
+The rebuilt artifacts (wheel `64e02c1a…`, sdist `d69ad3ce…`, upload commit
+`5ccf3666…`) were re-downloaded from the published repo via hf-mirror and
+hash-match byte-for-byte; a fresh uv venv (cr-m1-venv14) installed the
+downloaded-back wheel: `doctor` rc=0, `infer` rc=0
+`answered`/`provider_class=mock`/`verified_judgment`, second-process replay
+rc=0 with memory reuse. The first uploaded build's receipt (commit
+`4225068d`, wheel `803ee824…`) remains valid as history; the remote now
+serves the fix-up build.