diff --git a/harness/reviews/prerelease37-human-kits-20260924.md b/harness/reviews/prerelease37-human-kits-20260924.md
new file mode 100644
index 00000000..221664cd
--- /dev/null
+++ b/harness/reviews/prerelease37-human-kits-20260924.md
@@ -0,0 +1,40 @@
+# Prerelease 37 human companion kits: bounded static review
+
+Independent review on 2026-09-24 through read-only Gitea MCP at the exact commits below. Scope: missing fixture files, relative include closure, README target names and model expectations, and provenance consistency. No blocking finding was confirmed in that scope. This is preparation review, not acceptance of any application behavior.
+
+## Allocation and Process kit
+
+- Commit: `340a5c56b0783e22d7336a07ce96ddb7c2b79b0d`
+- Directory: `harness/prerelease37-human-checks-20260924`
+- Archive: `test-models.zip`, 17,190 bytes
+- Archive SHA-256: `17327e563af333fd9913f6d8b8a7e6ad0e095cea33393a5cad7a8b3397ffb185`, matching the published checksum file
+- README Git blob: `397bec67495ebacaae680ed6313578de6e958fbb`
+
+The ZIP has 28 unique members: README, provenance, 16 Allocation model files and 10 Process model files. Model membership exactly matches the provenance inventories. Every model file's byte length and SHA-256 matches its individual pin. The ZIP's parsed provenance equals the separately published provenance. Each `project.arcadia` reaches all files in its own model directory through relative includes; no missing include or unreachable model file was found. The archive was inspected in memory without extraction or execution.
+
+README project/view/card names match the declarations: Allocation group native; 01 OA assign, 02 SA assign, 03 OA arrange, 04 SA arrange; X - receive, Y - assess, C - destination, P - team, U - contained work, V - independent work, A - origin team and B - other team. SA Y has the named input-port record needed for the typed-set refusal exercise. Initial responsibility records assign X to A, Y to B and U to P; V is independent. Those records support the distinction between reassignment and presentation-only Arrange in the instructions.
+
+The Process folder declares Process group native and 01 OA group order, with Card A/B/C and Downstream U/V. Original steps are `[A,U,B,V,C]`; the stated group result `[B,U,A,V,C]` preserves downstream positions and A/C source order. Dragging C alone after B would leave that column unchanged, so the README's instruction to verify A moved is a useful discriminator. The README explicitly treats physical Shift and SA reopen as new human checks and records context-menu fallback separately, without converting fallback success into Shift acceptance.
+
+Provenance attributes the fixtures to source `495464e84b5bae8ddad93e9fc69ef353e7f1c884` and `b743a10d51032dc1655b94fed5e49fbbbcee83f4`, with original archive hashes and member prefixes. This review verified the supplied file pins; it did not download/reverify the two large original native archives.
+
+## State and Traceability kit
+
+- Commit: `1cd6e7d970f37e428165efaaf6900737ce03f636`
+- Directory: `harness/prerelease-human-checks-20260924`
+- README Git blob: `e9b1d06087eff74da6f5261f5d62c7a54a9ccd0f`
+- Provenance Git blob: `52baf34891378261ebc14fbe8c5945c973ccd1d3`
+
+All nine fixture files were retrieved at the exact kit commit. Every byte length and SHA-256 matches provenance. A second MCP read at each recorded original evidence commit/path confirmed identical base64 content and Git blob identity for all nine copies: State source/evidence `b8685416f56e53e30bd11ecf93a54cea10ac8458`; Traceability evidence `35b11eea34b1c7d0f3889648e5c01899e015ee70`, attributed to production source `17f1f89fef4a6bf520f4b09a2116548b967d030e`.
+
+`state/native-fixture.arcadia` is self-contained. It declares 03 Readiness — edit attachments, 04 Readiness — untouched reference, and Activate: Ready → Active as instructed. View03 initially has one authored waypoint for Activate plus its endpoint attachments; view04 has an empty routes collection and distinct placements. The README distinguishes square authored bends, round endpoint handles, attachment adjustment and semantic reconnect. No missing model or wrong target was found in these steps.
+
+`traceability/traceability-trial.arcadia` has a complete seven-file include closure. View01 places OA send, OA receive and SA send; existing Send refinement connects the two placed send subjects, while Receive refinement targets the initially unplaced SA receive. Thus the stated initial three-card/one-correspondence expectation and four-card/two-correspondence expectation after placing SA receive match the source structure. View02 independently places all four subjects. Entry, view, relation and counterpart names agree with the README.
+
+The copy-before-edit and Save As guidance correctly notes that changing only an entry filename does not isolate shared includes. Scope limitations distinguish prior State attachment evidence from pending picker/focused-input acceptance and exclude broad UI/accessibility/platform acceptance.
+
+## Method and limits
+
+No Git fetch, compilation, GUI operation, model execution, archived helper execution or Gitea write occurred. A small local helper decoded MCP-returned base64, inspected ZIP members, compared hashes and scanned literal includes. The first attempt exceeded Windows command-line length; a subsequent helper run exposed its own escaped-regex/output-encoding errors. Those local helper errors were corrected, and the successful final checks reported complete closures and matching byte pins. They are not kit defects. Local scratch input/helper files contain only retrieved public project data and no credentials.
+
+The review did not validate the numerical warning counts by running the model compiler, verify GUI labels against a newly built executable, or execute the human workflows. Passing source inventory checks does not establish loadability or feature correctness on the eventual prerelease binary. The final packaged application must open the fixtures and undergo the stated human checks.