diff --git a/harness/reviews/prerelease37-downloaded-package-20260924.md b/harness/reviews/prerelease37-downloaded-package-20260924.md
new file mode 100644
index 00000000..cbbcefde
--- /dev/null
+++ b/harness/reviews/prerelease37-downloaded-package-20260924.md
@@ -0,0 +1,43 @@
+# Downloaded Windows package integrity
+
+2026-09-24, Codex-956atf. Downloaded draft release 7 asset 25 from Gitea on this
+machine; the separately downloaded checksum asset 26 agrees exactly. This is
+transport/content verification, not native GUI or server acceptance.
+
+ZIP `ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip`:
+34,168,661 bytes, SHA-256
+`5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d`.
+The checksum is 144 bytes, SHA-256
+`41c7b1257660b66a44f27555e0e9613e7f6e4c0b119522347e3ccff54d60cea1`.
+Both match the builder's immutable handoff in issue37 comment1264.
+
+The previously prepared read-only ZIP inspector returned exit0. All 565 files
+match the complete internal checksum inventory; archive paths have the expected
+single root, no traversal, symlinks or case-colliding duplicates. Total
+uncompressed size is 182,276,890 bytes. Version/target/profile/source metadata
+identifies `715036e132677dd2bc2fb37ed316d93dc9987aec`, Windows gnullvm and the
+development profile. The exact three packaged product/runtime hashes match the
+[independently reviewed build receipts](prerelease37-final04-complete-20260924.md):
+
+| File | SHA-256 |
+| --- | --- |
+| `arcadia-studio.exe` | `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399` |
+| `arcadia-server.exe` | `6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237` |
+| `libunwind.dll` | `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a` |
+
+All 66 previously reviewed package documents/examples match their raw source
+hashes. Required launch/help/packaging/notices files are present; notice metadata
+identifies the same target and runtime hash. The package reports 18 checked
+local documentation links. This inspector checked the recorded import/notice
+metadata and its integrity; it did not independently analyze executable imports,
+regenerate dependency notices or run the packaged products. The separate
+downloaded-package QA and native/server evidence remain required.
+
+The two companion kit ZIPs and their SHA files (assets21–24) were also uploaded
+to this draft and freshly downloaded byte-for-byte. State/Traceability ZIP:
+9,691 bytes, SHA-256
+`6fda3606b4fe811906a60fbb8a3ba594f826d285dc2b4fc136ddccb64660d994`.
+Allocation/Process ZIP: 17,190 bytes, SHA-256
+`17327e563af333fd9913f6d8b8a7e6ad0e095cea33393a5cad7a8b3397ffb185`.
+They retain their separately reviewed fixture scope; this check does not claim
+all their human workflows were exercised against the package.