Round16 external document candidate generator

This helper has only prepare and verify commands. It has NO apply command. It never invokes a model, product test, build, scanner, app, native UI, or installation. All real settings/key/environment files and symlink inputs are rejected. Validator imports have bytecode writes disabled internally, so importing existing reviewed helpers does not write beside their source files.

Run only after the actual final receipts exist:

python3 "$GATE/round16/document-release-finalize/finalize.py" prepare --out "$GATE/round16/document-release-finalize/candidate-final-01"

Preparation refuses before publishing a candidate if actual receipts are missing, incomplete or mismatched. It requires the qualified r16b gate and fresh independent reviews, preserved failed r16a evidence, full31, snapshot10u185 and desktop/tests358 freezes, D16-7 repair receipts, build qualification and exact log/manifest bindings, installed bundle match and timestamp, native DSH actually executed, and final unchanged user-data metadata. It reads summaries/hashes only; it never opens real settings or installed artifacts.

The current release additionally requires the actual H16-15 resume chain. The original repository standalone smoke failed; the generator requires its exit 1, original 21 build files and original source copy to remain bound in a separate attempt1 archive. Canonical step 8 must identify the external adapter's actual argv, times, output and log, with unchanged gate/package proofs and four successful resume revalidations. README, checklist and audit explicitly distinguish this failed original script from the later external adapter result. The adapter scope is six loopback mock requests, explicit Guillotine and private Node/npm/npx module entrypoints; bare npx shell approval is not claimed. The earlier 34-check helper and receipt remain in before-h16-15/.

Record the returned manifest_sha256 outside the candidate. Review the generated documents, index, audit and matching assembler narrative before authorizing any publication. Then verify using that recorded hash:

python3 "$GATE/round16/document-release-finalize/finalize.py" verify --candidate "$GATE/round16/document-release-finalize/candidate-final-01" --expected-manifest-sha256 "<hash returned by prepare and reviewed by root>"

Verification requires the external manifest hash and unchanged output bytes, exact output file set, unchanged input hashes and still-valid actual receipts. Root must perform any later authorized publication separately; proposed_destinations is an explicit finite mapping, not an executable apply operation. Revalidate immediately before publication. Current source/doc/index inputs are deliberately bound, so an intervening edit requires review/re-preparation rather than silent merging.

Outputs:
- documents/: six document candidates plus updated wiring audit.
- gate/: new declaration index, audit assembly receipt and matching assembler narrative.
- lineage.json: original599 lineage source-line mapping and five explicit C corrections.
- manifest.json: commit marker; exact output hashes, actual input hashes and proposed destinations.

The old599 index and six baseline documents in document-release-prep/baseline remain immutable. The generator reconstructs their original semantic IDs, reads A evidence only from refreshed row JSON with exact bindings, shifts the four independently verified queryEngine C anchors in five C records, and never shifts A metadata a second time. New/changed statements are re-split; all old IDs must retain lineage and every checkbox must be indexed. Final claim count may differ from599.

README preserves Round15 as explicit history, records408 overlapping audit entries and all status boundaries, and includes receipt-derived tests, failed-a/full-b gate data and installed/native facts. The six documents intentionally make no final whole-evidence scan completion claim, avoiding scan/index/evidence circularity. The final report/evidence README must handle the separate actual scan and precisely bound a4+b3=7 authorized image-prefix coincidences; no other matches are authorized by this helper.

Synthetic self-check interface:

python3 finalize.py prepare --fixture-root "<new synthetic fixture root inside document-release-finalize>" --out "<new candidate path inside document-release-finalize>"

Fixture roots contain synthetic gate/ and repo/ trees. Fixture candidates are explicitly marked non-publishable, and the generated fixture assembler raises before executing. Never apply fixture candidates. The fixture suite uses explicit isolated HOME/USERPROFILE; it does not run product tests. See fixture-review/ for preserved positive/negative CLI logs, including the initial harmless SessionList duplicate-label fixture diagnostic.

adapter-fixture/ adds synthetic H16-15 receipts and reruns the existing 34 checks plus focused refusal cases. These tests fabricate isolated receipt data solely to test transformations and refusal behavior; they do not establish actual build, installation, native UI or release qualification. This helper has not generated a live release candidate during preparation.
