diff --git a/harness/STATE.md b/harness/STATE.md
index 8fbbbb34..7af48239 100644
--- a/harness/STATE.md
+++ b/harness/STATE.md
@@ -4,9 +4,17 @@ This describes Codex-956atf's contribution, not a combined release.
 [PROJECT_GOAL.md](../PROJECT_GOAL.md) remains authoritative. The complete OA/SA
 application is unfinished; published previews and finite prototypes are intermediate.
 
-**Linux/WSL builds and checks remain deferred until the user explicitly reports
-networking resolved.** No guest setup, diagnosis, restart or cache transfer is
-active. The VPN remains untouched.
+**The current prerelease is Windows-only. Linux/WSL builds and checks remain
+excluded by the user's explicit request, including after networking recovers.**
+
+The separately assembled Windows source is
+**9e99618cc32778cceed04f176fb476f191bf104e** on
+`codex/prerelease-integrated-956atf-20260924`. Its
+[source handoff](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/9e99618cc32778cceed04f176fb476f191bf104e/harness/prerelease-integrated-source-20260924.md)
+identifies the integrated contributions, reviewed event correction and exact
+test paths. Combined runtime/package acceptance is separate from the
+contribution-specific evidence below. [Issue37](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/37)
+owns current build and release coordination.
 
 ## Current integrated candidate and evidence
 
diff --git a/harness/reviews/prerelease37-human-kits-20260924.md b/harness/reviews/prerelease37-human-kits-20260924.md
index 221664cd..a28a2298 100644
--- a/harness/reviews/prerelease37-human-kits-20260924.md
+++ b/harness/reviews/prerelease37-human-kits-20260924.md
@@ -38,3 +38,20 @@ The copy-before-edit and Save As guidance correctly notes that changing only an
 No Git fetch, compilation, GUI operation, model execution, archived helper execution or Gitea write occurred. A small local helper decoded MCP-returned base64, inspected ZIP members, compared hashes and scanned literal includes. The first attempt exceeded Windows command-line length; a subsequent helper run exposed its own escaped-regex/output-encoding errors. Those local helper errors were corrected, and the successful final checks reported complete closures and matching byte pins. They are not kit defects. Local scratch input/helper files contain only retrieved public project data and no credentials.
 
 The review did not validate the numerical warning counts by running the model compiler, verify GUI labels against a newly built executable, or execute the human workflows. Passing source inventory checks does not establish loadability or feature correctness on the eventual prerelease binary. The final packaged application must open the fixtures and undergo the stated human checks.
+
+## State and Traceability ZIP transport follow-up
+
+- Published transport commit: `3005fccf23ab0433cbba6f76a0ad5d1ceca7fce4`
+- Archive: `harness/prerelease-human-checks-20260924.zip`, 9,691 bytes
+- SHA-256: `6fda3606b4fe811906a60fbb8a3ba594f826d285dc2b4fc136ddccb64660d994`
+- Git blob: `9da4e87f6c3507a326a58541a623cd1772b4613e`
+- Manifest: `harness/prerelease-human-checks-20260924-archive.json`, Git blob `71a20d5b2062785fcacc17066e5374d281c7a072`
+- Compared source kit: `1cd6e7d970f37e428165efaaf6900737ce03f636`, `harness/prerelease-human-checks-20260924`
+
+Read-only MCP retrieval and in-memory decoding confirmed the archive's actual byte length, SHA-256 and recomputed Git blob identity above. Its 12 unique, safe member names exactly match the source kit, under the single `prerelease-human-checks-20260924/` prefix: `.gitattributes`, `README.md`, `provenance.json`, `state/native-fixture.arcadia`, and the eight Traceability files listed below. Every member is byte-for-byte identical to its raw source-kit counterpart, including the nine previously reviewed model files; no member is missing, extra or reencoded.
+
+The eight Traceability members, relative to `traceability/`, are `traceability-trial.arcadia`, `traceability.arcadia`, `oa/activities/activity_oa_receive.arcadia`, `oa/activities/activity_oa_send.arcadia`, `sa/functions/function_sa_receive.arcadia`, `sa/functions/function_sa_send.arcadia`, `views/diagram_trace_view_100.arcadia`, and `views/diagram_trace_view_200.arcadia`.
+
+The sibling manifest identifies the same source commit. Its archive size/hash, exact member inventory, and all 12 individual size/hash pins match the downloaded ZIP. An initial supplemental manifest-check helper incorrectly duplicated the already-present root prefix; correcting that local path assumption produced a passing check. This was a helper error, not an archive defect.
+
+The prior nine-file provenance, include-closure and README conclusions therefore apply unchanged to this transport. No blocking transport finding was found. This follow-up did not extract or execute archive content, repeat GUI/compiler checks, fetch Git objects, download original large evidence archives or write to Gitea. It establishes faithful delivery of the reviewed companion kit, not runtime or combined prerelease acceptance. Only this local review was appended; the previously published review at `0f5f8fb7` was not edited.