[gavinying]

Summary

Approved profile 0.2 TM
├── validate audit identity/status references
├── derive independent read-only TM with exact spans
└── project point rows from the selected TM bytes

Evidence

• Before: The published interpreter rejects the audit extension.
• After: 68 producer tests passed. The a4 wheel built from the sdist installed independently and exposed both delivery APIs.

Merge Danger

Door: Two-way before tagging. The subsequent PyPI release is immutable.

Blast Radius: Shared interpreter. Application dependency pins stay on their existing releases until the producer is verified.