diff --git a/harness/experiments/prerelease37-package-integrity-20260924/.gitattributes b/harness/experiments/prerelease37-package-integrity-20260924/.gitattributes
new file mode 100644
index 00000000..7c9ec5c8
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/.gitattributes
@@ -0,0 +1,4 @@
+inspect_studio_package.py -text
+inspection.json -text
+download.json -text
+documents.json -text
diff --git a/harness/experiments/prerelease37-package-integrity-20260924/README.md b/harness/experiments/prerelease37-package-integrity-20260924/README.md
new file mode 100644
index 00000000..23f86ec0
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/README.md
@@ -0,0 +1,19 @@
+# Downloaded package inspection
+
+These files preserve the parent download/content check described in the
+[scope and result report](../../reviews/prerelease37-downloaded-package-20260924.md).
+`inspection.json` is the successful inspector's raw output; `download.json`
+identifies release7/asset25; `documents.json` holds the previously reviewed
+66 source-file hashes. The script performs read-only ZIP/hash checks and does
+not execute the product. It uses the binary pins from the separately reviewed
+build evidence. Its SHA-256 is
+`35f15e753c41146eb467e60f83f5b727811a12516126b448b83edd2a4fadd32c`.
+
+From this directory, with Python assertions enabled:
+
+```text
+python -I -B inspect_studio_package.py PATH_TO_DOWNLOADED_ZIP --archive-sha256 5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d --source 715036e132677dd2bc2fb37ed316d93dc9987aec --version 0.2.0-preview.integrated.20260924 --desktop-sha256 2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399 --server-sha256 6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237 --runtime-sha256 aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a --documents-receipt documents.json
+```
+
+Gitea draft access requires an authorized account. Asset transport and integrity
+do not establish packaged GUI/server behavior. No Linux checks are included.
diff --git a/harness/experiments/prerelease37-package-integrity-20260924/documents.json b/harness/experiments/prerelease37-package-integrity-20260924/documents.json
new file mode 100644
index 00000000..2bbd33a6
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/documents.json
@@ -0,0 +1,539 @@
+{
+  "source": "897d9f049406d5be597543eb0a6755b796259302",
+  "platform": "windows",
+  "result": "PASS",
+  "scope": "Documentation/example closure and tracked source identity only; no build or runtime acceptance.",
+  "file_count": 66,
+  "raw_bytes": 1449245,
+  "raw_git_differences": 0,
+  "files": [
+    {
+      "package_path": "LICENSE",
+      "source_path": "LICENSE",
+      "git_blob": "982e1c9a02c8d24faadb208c6284e5b57817dacb",
+      "bytes": 1084,
+      "sha256": "51009f2cb07e5d19645858b2fbc037a672a25f8cbf7999522942b86807ecf365",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "README.md",
+      "source_path": "scripts/package-readme.md",
+      "git_blob": "4588683c69b946260abf84047be16f40e3483670",
+      "bytes": 1902,
+      "sha256": "597cfb8da873e019d2658420f18ec059f0185fa9106ff9eafe934dfdd6ed266b",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "deployment/Dockerfile",
+      "source_path": "deployment/Dockerfile",
+      "git_blob": "198c5c459a7ff8fa3129bb5fa2238ede5c73b19c",
+      "bytes": 1340,
+      "sha256": "72c04aef4ec879955ed3bdf315987553d018ef46e4b8f350f0f6fe380c453eb7",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "deployment/Dockerfile.dockerignore",
+      "source_path": "deployment/Dockerfile.dockerignore",
+      "git_blob": "0c32edaf8327decd61e77e9760830ea93eeacddf",
+      "bytes": 509,
+      "sha256": "6bb7d7496110b11a531cb8cd923864c6610850a8f1c4de8a797f54c7156f29e1",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "deployment/arcadia-server.service",
+      "source_path": "deployment/arcadia-server.service",
+      "git_blob": "bde982f96404e9cca8bc73237c4bb848a714b140",
+      "bytes": 536,
+      "sha256": "1e6c6bb4065e25f8fe1d558a4ed0bbd4844782a4377c2482488db1e6f9cab01d",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/api.html",
+      "source_path": "docs/api.html",
+      "git_blob": "3a07e50c78d3bfcd373a5e99cd2279ec99d66ec8",
+      "bytes": 74641,
+      "sha256": "d06e32b3da838e519630a4151111bb40a383ccf294eb18443118a7498700a993",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/api.rst",
+      "source_path": "docs/api.rst",
+      "git_blob": "ed7617cb37a264270f8cd0a77239e84f9162a222",
+      "bytes": 43564,
+      "sha256": "d78f138d011dd0af28bd53a65d1d93381d031f680191779d4f3030a264eb2e74",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/language.html",
+      "source_path": "docs/language.html",
+      "git_blob": "ddae88761db5e4bfde1ec5086c419ccd031e4d63",
+      "bytes": 191933,
+      "sha256": "77c14e548f5d2deea0c21a3a931347e1c87449f5be8503f6c51ceaef37be9a33",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/language.rst",
+      "source_path": "docs/language.rst",
+      "git_blob": "028db93bec99fb065c26610532c332288d92924c",
+      "bytes": 146279,
+      "sha256": "7117a66e16b34cd6ce033532e984c7ca49b4611e296fb1c46c5f737fe9169ec6",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/linux-packaging.md",
+      "source_path": "docs/linux-packaging.md",
+      "git_blob": "26847e1ec55864f951d1445c56cd3194b9f8bc64",
+      "bytes": 8671,
+      "sha256": "41a1bb1095801df37a1411341c5791d55ea8c365739314d599a60269ac4bc7a0",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/openapi.json",
+      "source_path": "docs/openapi.json",
+      "git_blob": "b4feebe5f7945b27e48551aea1239f23527c1d1f",
+      "bytes": 348802,
+      "sha256": "2ad69da52fb574435525990c906948ce54b1efd9247cdde8726969f382731790",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/preview-human-checks.md",
+      "source_path": "docs/preview-human-checks.md",
+      "git_blob": "be349c4b52be06e0c60e65e39fa5dde1f3f1b3f9",
+      "bytes": 3840,
+      "sha256": "50b56c328c22587e1187f6e614bc914210095cf635c301f335e82de11201b890",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/research-v2-service.md",
+      "source_path": "docs/research-v2-service.md",
+      "git_blob": "d3511c6f546d82253351e21c6ac1103c5f2ba542",
+      "bytes": 36209,
+      "sha256": "4828df5bc679e7c71f49b4b85c9e7dacbec52f46d416fed48af70e08886d4e4e",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/server.md",
+      "source_path": "docs/server.md",
+      "git_blob": "a1eb4c11475c3273d421ede045679231f561491d",
+      "bytes": 23361,
+      "sha256": "4eb24937d424ba8b384e1734e02a6f8e963ae11d2715889c92b14b39ff2e4a48",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "docs/windows-packaging.md",
+      "source_path": "docs/windows-packaging.md",
+      "git_blob": "8805d63b4c3b09476bc1462df7779e715dfc0815",
+      "bytes": 10597,
+      "sha256": "2d5ef8a9a8741e6e7f6df9db9fd9a839f806ea782a6f2063c3a98725ecfd36b6",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/coastal-rescue.arcadia",
+      "source_path": "examples/coastal-rescue.arcadia",
+      "git_blob": "1785aa23ba4e74f79642b3ec1b11f35fda3cc162",
+      "bytes": 33107,
+      "sha256": "7e183ef9fd8154d3074303f1956cd0d9871c19e3ffc630d333b0bffbd6e30e17",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/coastal-rescue.json",
+      "source_path": "examples/coastal-rescue.json",
+      "git_blob": "77cdcd23552e4ddd89b0953935c1c2143f277e21",
+      "bytes": 49715,
+      "sha256": "242f0b031229a87af5c4ebe5d651defe59c191a6b7a69dc0a77f7e203411f195",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/legacy-v1-coastal-rescue.arcadia",
+      "source_path": "examples/legacy-v1-coastal-rescue.arcadia",
+      "git_blob": "5e1e202faaa9c011b2146eb04540459b0e6eaea2",
+      "bytes": 3449,
+      "sha256": "4dbbbdf8bc7e6cb8e0a81dd678069dae585a9e5187c59bc3665e1fdab3f1a86a",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/legacy-v1-coastal-rescue.oa.json",
+      "source_path": "examples/legacy-v1-coastal-rescue.oa.json",
+      "git_blob": "e0a659c82a872646e6d50931e84cbccc7cf15019",
+      "bytes": 5976,
+      "sha256": "fd0e9dedfb7adb922dc0575cc2b820d40344d639f1d8052bd70363aa59de9c24",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/README.md",
+      "source_path": "examples/release1/README.md",
+      "git_blob": "f6f883d175952d84a1da05bab15db8e333d88d13",
+      "bytes": 11137,
+      "sha256": "113cfb1cf38a98b51bff60442d86a35d636a3d80ef206bece7d53d0aae67f2d5",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/evidence/repair-check.md",
+      "source_path": "examples/release1/evidence/repair-check.md",
+      "git_blob": "b3e9ddf8e67b58c2f9c9650abb23495c81e1acab",
+      "bytes": 1419,
+      "sha256": "f4db17bdca4ecbb1bf0caef01b2da5f1f7f798ab3152b648ce6dd8696a6a68e5",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/expected-diagnostics.json",
+      "source_path": "examples/release1/expected-diagnostics.json",
+      "git_blob": "e93a7fa798e47ea264220bd098df742a3b67d6da",
+      "bytes": 288,
+      "sha256": "3700393d76b940cfc076bf52861bd7b1f43370f8eabce3594531bd0bf1fc851e",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/model.json",
+      "source_path": "examples/release1/model.json",
+      "git_blob": "dd61c402df40b6c300b4e374c52a8fd59870a7f1",
+      "bytes": 134520,
+      "sha256": "ef0ef4006c3e09d5db6e1b621256b3f7d6642f3a7b09cc34607cfbcca830c727",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/model.rs",
+      "source_path": "examples/release1/model.rs",
+      "git_blob": "3f7e6e361f507574de1ba412f6fc3337f2ef3c6c",
+      "bytes": 28776,
+      "sha256": "ddc2d92b0d7699a4cadfbb35ae379f0a68d17f4f5d7df82b4b1afcf8d5425fbe",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/activities/activity_oa_restore_work.arcadia",
+      "source_path": "examples/release1/oa/activities/activity_oa_restore_work.arcadia",
+      "git_blob": "fb4a36e18d4df97faf41e1f59c295a00b554db5a",
+      "bytes": 1130,
+      "sha256": "21cbd7176af8fad68453306f2371ff03e127a994b8796cdf044567332de9686f",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/process_oa_assessment_procedure.arcadia",
+      "source_path": "examples/release1/oa/behavior/process_oa_assessment_procedure.arcadia",
+      "git_blob": "3824af89fec6186d0a163e3e3629328f0281e7b2",
+      "bytes": 550,
+      "sha256": "23cabc213c264a16c8595414db6acb09248c1cef9cd699f1b0316e5bb82c062a",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/process_oa_field_procedure.arcadia",
+      "source_path": "examples/release1/oa/behavior/process_oa_field_procedure.arcadia",
+      "git_blob": "20502f8bb58eded51bcb834559c62a85070c9769",
+      "bytes": 1178,
+      "sha256": "9c52086759b7344b4809ceb8d372f65647b16fc24153a03b887faa378c37fe96",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/process_oa_response.arcadia",
+      "source_path": "examples/release1/oa/behavior/process_oa_response.arcadia",
+      "git_blob": "4970a5a552aa613cc5477abd6892af3cbc6deb33",
+      "bytes": 2560,
+      "sha256": "675798bd19e6b40d03e7076b0e59b110cdaaab7b6d16c47c3ac80fa960072e84",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/scenario_oa_conversation.arcadia",
+      "source_path": "examples/release1/oa/behavior/scenario_oa_conversation.arcadia",
+      "git_blob": "83c3f1d470180f8eb68b722b5485403dfdd588be",
+      "bytes": 1515,
+      "sha256": "e217e5394a0771dc16206ed9437a231da27905d2f19be64b3f48281c0a32fb6b",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia",
+      "source_path": "examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia",
+      "git_blob": "1ff7d7e428409d05e9a3deb3e58907e6ad681238",
+      "bytes": 1121,
+      "sha256": "c5a285f2d7c61bd2a136107f267fbf9cddb1cba3f63ff36a6f53f7ab98f33df5",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/behavior/state_machine_oa_monitor.arcadia",
+      "source_path": "examples/release1/oa/behavior/state_machine_oa_monitor.arcadia",
+      "git_blob": "5ccabfc4b40c94ea86a3faa0f47bbe1774422be5",
+      "bytes": 1358,
+      "sha256": "e7349e1e5336282eed3f5a103129db33d3ae4ed500788ee7129e8fc193ac57f6",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/capabilities.arcadia",
+      "source_path": "examples/release1/oa/capabilities.arcadia",
+      "git_blob": "d7c2acda6debe1c8e59a713ad004c32cbcf8905b",
+      "bytes": 630,
+      "sha256": "26a3d9b615a3251ff010e0b47127f2d16bc2dcd45ed95967208b0076d725843a",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/model.arcadia",
+      "source_path": "examples/release1/oa/model.arcadia",
+      "git_blob": "f2308e9498d30eeb70801768d08065a65f8bdf51",
+      "bytes": 531,
+      "sha256": "069a5eaaf525089935cc9d73ae7b916866ed78c6534705d75739650ecdea7ada",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/participants.arcadia",
+      "source_path": "examples/release1/oa/participants.arcadia",
+      "git_blob": "7edbab4457bca6558bab088380980bae5b8a6444",
+      "bytes": 1580,
+      "sha256": "591a75a9ecad280302be4d4ae0171ad616377ed11ead5e233848ca2dc0a71819",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/oa/types.arcadia",
+      "source_path": "examples/release1/oa/types.arcadia",
+      "git_blob": "c4597556ff22e34f2b1016716ed2a653528b536c",
+      "bytes": 554,
+      "sha256": "f02c391d584674c879f662a418abba3a220f1fee88471ca49322ac9873de628d",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/project.arcadia",
+      "source_path": "examples/release1/project.arcadia",
+      "git_blob": "702dd7a313c1d135ce02a961b6fd5e19f8fc5967",
+      "bytes": 1958,
+      "sha256": "b2674e6bf77cfe0f6f0ba79c81d2e96d92f39c02ca2c6266d80e91723bfb9fda",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/process_sa_assessment_procedure.arcadia",
+      "source_path": "examples/release1/sa/behavior/process_sa_assessment_procedure.arcadia",
+      "git_blob": "c368828ea1bd8cc5fd8b5c518e26cda6bebdae23",
+      "bytes": 559,
+      "sha256": "5c414fbdaabf9f9e402b0441fcacf1cacf4dbbc6c822162f028de35abf59be2d",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/process_sa_field_procedure.arcadia",
+      "source_path": "examples/release1/sa/behavior/process_sa_field_procedure.arcadia",
+      "git_blob": "04ff2eee9e607f65b283be0981e77ed5a4b4c8e5",
+      "bytes": 1187,
+      "sha256": "ece846fdf93857e71a9ab0efcbdf64a5c41c71180f62afa3f79077fffb53b8f2",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/process_sa_response.arcadia",
+      "source_path": "examples/release1/sa/behavior/process_sa_response.arcadia",
+      "git_blob": "d56a692d2d9f07e9a5535c5a114a77b7090c7198",
+      "bytes": 2569,
+      "sha256": "af7fdda280a917cf626f6e077162d481f9aaad280f8e81330c07d7fe384b1c52",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/scenario_sa_conversation.arcadia",
+      "source_path": "examples/release1/sa/behavior/scenario_sa_conversation.arcadia",
+      "git_blob": "8f19ca0645be71c5f39f8c459bdf4018063dad90",
+      "bytes": 1847,
+      "sha256": "01339699ec3ee409418d9bb232542f2bcd9419f1e67b183e77700c56bb9f71d2",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/scenario_sa_full_scenario.arcadia",
+      "source_path": "examples/release1/sa/behavior/scenario_sa_full_scenario.arcadia",
+      "git_blob": "96bbfa559d6472dc49f314638549719466cfee22",
+      "bytes": 1116,
+      "sha256": "5dce6b00a3a441162e8dee3e23d9ca5ab7bed4a24de669b1fba03664a3086dda",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/behavior/state_machine_sa_monitor.arcadia",
+      "source_path": "examples/release1/sa/behavior/state_machine_sa_monitor.arcadia",
+      "git_blob": "3f2dc53341b29f7a5288b2a81055a6175e039b38",
+      "bytes": 1358,
+      "sha256": "17dbcfa5bbfd10fc8e23a325fc950ce853c219b4aa89c74f96278cbb3f34acc8",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/capabilities.arcadia",
+      "source_path": "examples/release1/sa/capabilities.arcadia",
+      "git_blob": "464e751d82793306b0e6da880b60f881e2285a17",
+      "bytes": 630,
+      "sha256": "81706a0ca9d7db2aa0350888b9c00d853885185db2e6b90557d3d51a11c3d645",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/functions/function_sa_audit_thresholds.arcadia",
+      "source_path": "examples/release1/sa/functions/function_sa_audit_thresholds.arcadia",
+      "git_blob": "a9c49d2b55e2392929229e04c015b61d870808f5",
+      "bytes": 280,
+      "sha256": "27f798f78f36e72b38edab3725af2feb0eaa010fd52a60b5c6b6bef57ad3b686",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/functions/function_sa_restore_work.arcadia",
+      "source_path": "examples/release1/sa/functions/function_sa_restore_work.arcadia",
+      "git_blob": "7a84b35b4a553cf9387715b5014086ab6e5453fb",
+      "bytes": 2251,
+      "sha256": "357c6acb80f86b4e8d8f5c98f9f79d140f85fbe09f3406b41b7ac6eba464ec8c",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/model.arcadia",
+      "source_path": "examples/release1/sa/model.arcadia",
+      "git_blob": "47f9ff5414fb23a955884c2702bc2289d989f1a1",
+      "bytes": 531,
+      "sha256": "805b90262e27090ae7da81a51bcefa49c97fb0b3d3220b4a72323b4c4351c395",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/participants.arcadia",
+      "source_path": "examples/release1/sa/participants.arcadia",
+      "git_blob": "3bb62d30049dbc84d73841fb549a4e1abca80777",
+      "bytes": 3604,
+      "sha256": "ca144d6a8f45fe720b5d18c7b59c7671444baa8c37e5ce9117bcba34b3a6aa84",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/sa/types.arcadia",
+      "source_path": "examples/release1/sa/types.arcadia",
+      "git_blob": "e876932a0b236c6a022a1361b39d5ffb1185d0b1",
+      "bytes": 903,
+      "sha256": "540ddbc2bcd0ccf45298e3ea5660637341aff63ff65fd87ac2f26469d1adc064",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/traceability.arcadia",
+      "source_path": "examples/release1/traceability.arcadia",
+      "git_blob": "6a5bb1021368d9958baa469030bdb1464188c69e",
+      "bytes": 28041,
+      "sha256": "474bd28d955ff7af7722f6e9a23220d816879e3f46202e79a233544b9c593116",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/transition-before.json",
+      "source_path": "examples/release1/transition-before.json",
+      "git_blob": "71f12774cb2192e2ab2627b57cd365ef0d21fb66",
+      "bytes": 35801,
+      "sha256": "2253e6434f741687e22327c37d520ed15c043bc36025498650bc2366bb6a874d",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/transition-request.json",
+      "source_path": "examples/release1/transition-request.json",
+      "git_blob": "b2cc442b89e14d9753996f1c32c0fb5aeb702758",
+      "bytes": 4276,
+      "sha256": "43b9a22e5f95ad3bc0ebd2478ead0e14406854abc989ae94ded9367b013d812a",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/views/diagram_oa_allocation_view.arcadia",
+      "source_path": "examples/release1/views/diagram_oa_allocation_view.arcadia",
+      "git_blob": "05bf689092f251b732c962cff2573e8e2e891dd9",
+      "bytes": 1786,
+      "sha256": "c45d7467839219d894804c1ef2d22ff4d4a5a84a6a273c526bafd4c1facde624",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/views/diagram_sa_allocation_view.arcadia",
+      "source_path": "examples/release1/views/diagram_sa_allocation_view.arcadia",
+      "git_blob": "ff60c8b80951b83a85f10e82d6d9807905264fae",
+      "bytes": 1797,
+      "sha256": "352a3ca745517592b5c9b1239b5770f62f0466a329a91fd03457ef2b53c06ed6",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/views/diagram_sa_capability_view.arcadia",
+      "source_path": "examples/release1/views/diagram_sa_capability_view.arcadia",
+      "git_blob": "9033d91ef18d87f736190e1d8ac28771ffc9f8a8",
+      "bytes": 1286,
+      "sha256": "8f18fcccbcddcf3c1ea0ffe727b5b23b77fc148c5da4fde953abe681e4c20cd2",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/views/diagram_sa_service_view.arcadia",
+      "source_path": "examples/release1/views/diagram_sa_service_view.arcadia",
+      "git_blob": "90d331f08b89b718b01fb069457b3271eaa2babc",
+      "bytes": 1960,
+      "sha256": "4c72cb7593d9c4be8d2600b0656a7a3a6ce84c45bb2f3e58a4ee5ae3bf91913c",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/release1/views/diagram_sa_state_view.arcadia",
+      "source_path": "examples/release1/views/diagram_sa_state_view.arcadia",
+      "git_blob": "37116b80d8caa61e5deb1a2d73cd2b6df12d20a0",
+      "bytes": 1576,
+      "sha256": "dd1bea81ac7dc549a53f9b190be6f13052e00ede345bd180444cc31edb892230",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/routing-workshop.arcadia",
+      "source_path": "examples/routing-workshop.arcadia",
+      "git_blob": "d136d37ed3a298bd46c98c668f29297ff5b4f241",
+      "bytes": 66431,
+      "sha256": "dc6b75da72884d399132ed9e300fa5a26b73d802bb526c9af986ae9eeb0a646a",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/routing-workshop.json",
+      "source_path": "examples/routing-workshop.json",
+      "git_blob": "f67fa011a25d16348e055f66ef3aa69d7a9375bb",
+      "bytes": 100281,
+      "sha256": "8592714f75b271133f21ce017d87896b6cf91ea0e4837f1c2ed453e21be26b14",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/oa.arcadia",
+      "source_path": "examples/source-project/oa.arcadia",
+      "git_blob": "0aa8c9ddbfcc1fb2287559d9cc529898dedd1b97",
+      "bytes": 2142,
+      "sha256": "5f60642f211b2d352a951092faeeb7503d4fb7f6f7fca99e810347231101d31c",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/project.arcadia",
+      "source_path": "examples/source-project/project.arcadia",
+      "git_blob": "8bb4292f25b31ea53af9cac665a9043fd2130dc7",
+      "bytes": 606,
+      "sha256": "787f6b67b179ffd221f7e5faf1a4edd74cfd116aa1e3b5e9ed9f22fbff612d8d",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/sa/assurance.arcadia",
+      "source_path": "examples/source-project/sa/assurance.arcadia",
+      "git_blob": "b9678cbee4c3210e20131e363b915a1afc4b272a",
+      "bytes": 682,
+      "sha256": "ab76044836e4dcd42a82d316846ec87da2108939aa2037640c5bca1d2ecdee0f",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/sa/participants.arcadia",
+      "source_path": "examples/source-project/sa/participants.arcadia",
+      "git_blob": "cdd7f402b0f4327c8382763f7dd9def702759c0c",
+      "bytes": 1231,
+      "sha256": "1abad579812e77877b45a3d8e3c3e9da734be2d04a0254cc730a5257ebd2dc88",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/sa/reporting.arcadia",
+      "source_path": "examples/source-project/sa/reporting.arcadia",
+      "git_blob": "bfeac4b0b37ab3166c149ce482e99e8ea40419ba",
+      "bytes": 2839,
+      "sha256": "f0b7443f728912ca163de39b6055876b533a77feaa3219b2d40a2dd65712e058",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/source-project/views.arcadia",
+      "source_path": "examples/source-project/views.arcadia",
+      "git_blob": "62d9b5cbac461a2bc7dda6f91686ab741a93c14b",
+      "bytes": 3508,
+      "sha256": "e29ad3f406a6a50d2f0ae2ca2a53ee3b0c18222cd4098704a46d4f48b64ea17f",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/text-first/README.md",
+      "source_path": "examples/text-first/README.md",
+      "git_blob": "4f7832723554eb57dfdae9400b57a591ab4a5bbf",
+      "bytes": 1367,
+      "sha256": "4ec8250d5ed556f1d496e8c85137e973e802ecb11df1a36488411e8cdc5a9f9e",
+      "raw_equals_git_blob": true
+    },
+    {
+      "package_path": "examples/text-first/project.arcadia",
+      "source_path": "examples/text-first/project.arcadia",
+      "git_blob": "e6d0e9c65ea866a3c8702e234bb45801191c8629",
+      "bytes": 480,
+      "sha256": "f441535c623e0cf20e1875eb2cd33b587ed00e078c37af39cb36d89bb5edc19a",
+      "raw_equals_git_blob": true
+    }
+  ]
+}
diff --git a/harness/experiments/prerelease37-package-integrity-20260924/download.json b/harness/experiments/prerelease37-package-integrity-20260924/download.json
new file mode 100644
index 00000000..02705464
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/download.json
@@ -0,0 +1,8 @@
+{
+  "release_id": 7,
+  "asset_id": 25,
+  "name": "ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip",
+  "bytes": 34168661,
+  "sha256": "5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d",
+  "download_url": "http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/download/v0.2.0-preview.integrated.20260924/ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip"
+}
diff --git a/harness/experiments/prerelease37-package-integrity-20260924/inspect_studio_package.py b/harness/experiments/prerelease37-package-integrity-20260924/inspect_studio_package.py
new file mode 100644
index 00000000..903e91fe
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/inspect_studio_package.py
@@ -0,0 +1,92 @@
+"""Inspect a downloaded Windows ZIP without extracting or running its contents.
+
+Expected archive/binary hashes must come from separately reviewed build evidence.
+This checks artifact integrity and provenance assertions, not native acceptance.
+"""
+import argparse
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import re
+import stat
+import zipfile
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('archive', type=Path)
+for option in ('archive-sha256', 'source', 'version', 'desktop-sha256', 'server-sha256', 'runtime-sha256'):
+    parser.add_argument('--' + option, required=True)
+parser.add_argument('--documents-receipt', required=True, type=Path)
+args = parser.parse_args()
+
+def sha(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+for value in (args.archive_sha256, args.desktop_sha256, args.server_sha256, args.runtime_sha256):
+    assert re.fullmatch(r'[0-9a-f]{64}', value), 'Expected lowercase SHA256 required'
+assert re.fullmatch(r'[0-9a-f]{40}', args.source), 'Exact source commit required'
+assert sha(args.archive.read_bytes()) == args.archive_sha256, 'Archive checksum differs'
+target = 'x86_64-pc-windows-gnullvm'
+root = f'ArcadiaStudio-{args.version}-{target}/'
+expected_binaries = {'arcadia-studio.exe': args.desktop_sha256,
+                     'arcadia-server.exe': args.server_sha256,
+                     'libunwind.dll': args.runtime_sha256}
+with zipfile.ZipFile(args.archive) as archive:
+    infos = archive.infolist()
+    assert sum(row.file_size for row in infos) <= 1024 ** 3, 'Unexpected package size'
+    assert len({row.filename.casefold() for row in infos}) == len(infos), 'Duplicate/case-colliding archive members'
+    files = {}
+    for row in infos:
+        name = row.filename
+        path = PurePosixPath(name)
+        assert not path.is_absolute() and '..' not in path.parts and '\\' not in name and ':' not in name
+        assert name.startswith(root), 'Unexpected archive root'
+        assert not stat.S_ISLNK(row.external_attr >> 16), 'Symlink archive member'
+        if not row.is_dir():
+            relative = name[len(root):]
+            assert relative and relative not in files
+            files[relative] = sha(archive.read(row))
+
+    def read(name):
+        assert name in files, 'Missing required package member: ' + name
+        return archive.read(root + name)
+
+    checksums = {}
+    for line in read('SHA256SUMS.txt').decode('utf-8-sig').splitlines():
+        match = re.fullmatch(r'([0-9a-f]{64})  (.+)', line)
+        assert match, 'Malformed package checksum line'
+        digest, name = match.groups()
+        assert name not in checksums, 'Duplicate package checksum path'
+        checksums[name] = digest
+    assert set(files) == set(checksums) | {'SHA256SUMS.txt'}, 'Missing or unexpected package files'
+    assert 'SHA256SUMS.txt' not in checksums
+    assert all(files[name] == digest for name, digest in checksums.items()), 'Package file checksum differs'
+    metadata = json.loads(read('package.json'))
+    assert metadata['version'] == args.version and metadata['target'] == target
+    for name, digest in metadata['input_sha256'].items():
+        assert files.get(name) == digest, 'Package input differs: ' + name
+    for name, digest in expected_binaries.items():
+        assert files.get(name) == metadata['input_sha256'].get(name) == digest, 'Build artifact differs: ' + name
+    build = metadata['build_evidence']['evidence']
+    assert build['source_identity'] == args.source, 'Source assertion needs exact commit or explicit review'
+    assert build['profile'] == 'dev' and build['target'] == target and build['compiler']
+    for name in ('arcadia-studio.exe', 'arcadia-server.exe'):
+        assert build['binary_sha256'][name] == expected_binaries[name]
+    for name in ('README.md', 'START-HERE.txt', 'LICENSE', 'docs/windows-packaging.md',
+                 'docs/preview-human-checks.md', 'THIRD-PARTY-NOTICES.txt', 'dependency-notices.json'):
+        read(name)
+    document_check = json.loads(read('documentation-check.json'))
+    assert 'checked_local_document_links' in document_check
+    notices = json.loads(read('dependency-notices.json'))
+    assert notices['target'] == target and notices['runtime']['sha256'] == args.runtime_sha256
+    documents = json.loads(args.documents_receipt.read_text(encoding='utf-8-sig'))
+    assert documents['result'] == 'PASS' and len(documents['files']) == documents['file_count']
+    for row in documents['files']:
+        assert files.get(row['package_path']) == row['sha256'], 'Reviewed document bytes differ: ' + row['package_path']
+    print(json.dumps({'archive': args.archive.name, 'archive_sha256': args.archive_sha256,
+                      'version': args.version, 'source_assertion': args.source,
+                      'package_files': len(files), 'uncompressed_bytes': sum(row.file_size for row in infos),
+                      'verified_binary_sha256': expected_binaries,
+                      'reviewed_document_files': len(documents['files']),
+                      'document_links': document_check['checked_local_document_links'],
+                      'compiler_assertion': build['compiler'], 'imports': metadata['imports'],
+                      'scope': 'Archive integrity, supplied build hashes and reviewed document bytes; no binary execution or native acceptance.'}, indent=2))
diff --git a/harness/experiments/prerelease37-package-integrity-20260924/inspection.json b/harness/experiments/prerelease37-package-integrity-20260924/inspection.json
new file mode 100644
index 00000000..087db2eb
--- /dev/null
+++ b/harness/experiments/prerelease37-package-integrity-20260924/inspection.json
@@ -0,0 +1,74 @@
+{
+  "archive": "ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip",
+  "archive_sha256": "5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d",
+  "version": "0.2.0-preview.integrated.20260924",
+  "source_assertion": "715036e132677dd2bc2fb37ed316d93dc9987aec",
+  "package_files": 565,
+  "uncompressed_bytes": 182276890,
+  "verified_binary_sha256": {
+    "arcadia-studio.exe": "2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399",
+    "arcadia-server.exe": "6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237",
+    "libunwind.dll": "aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a"
+  },
+  "reviewed_document_files": 66,
+  "document_links": 18,
+  "compiler_assertion": "rustc 1.98.1 (48a229cea 2026-09-01)",
+  "imports": {
+    "arcadia-studio.exe": [
+      "advapi32.dll",
+      "api-ms-win-core-synch-l1-2-0.dll",
+      "api-ms-win-crt-environment-l1-1-0.dll",
+      "api-ms-win-crt-heap-l1-1-0.dll",
+      "api-ms-win-crt-locale-l1-1-0.dll",
+      "api-ms-win-crt-math-l1-1-0.dll",
+      "api-ms-win-crt-private-l1-1-0.dll",
+      "api-ms-win-crt-runtime-l1-1-0.dll",
+      "api-ms-win-crt-stdio-l1-1-0.dll",
+      "api-ms-win-crt-string-l1-1-0.dll",
+      "bcrypt.dll",
+      "bcryptprimitives.dll",
+      "dwmapi.dll",
+      "gdi32.dll",
+      "imm32.dll",
+      "kernel32.dll",
+      "libunwind.dll",
+      "ntdll.dll",
+      "ole32.dll",
+      "oleaut32.dll",
+      "opengl32.dll",
+      "shell32.dll",
+      "user32.dll",
+      "uxtheme.dll",
+      "ws2_32.dll"
+    ],
+    "arcadia-server.exe": [
+      "api-ms-win-core-synch-l1-2-0.dll",
+      "api-ms-win-crt-environment-l1-1-0.dll",
+      "api-ms-win-crt-heap-l1-1-0.dll",
+      "api-ms-win-crt-locale-l1-1-0.dll",
+      "api-ms-win-crt-math-l1-1-0.dll",
+      "api-ms-win-crt-private-l1-1-0.dll",
+      "api-ms-win-crt-runtime-l1-1-0.dll",
+      "api-ms-win-crt-stdio-l1-1-0.dll",
+      "api-ms-win-crt-string-l1-1-0.dll",
+      "bcryptprimitives.dll",
+      "kernel32.dll",
+      "libunwind.dll",
+      "ntdll.dll",
+      "ws2_32.dll"
+    ],
+    "libunwind.dll": [
+      "api-ms-win-crt-convert-l1-1-0.dll",
+      "api-ms-win-crt-environment-l1-1-0.dll",
+      "api-ms-win-crt-filesystem-l1-1-0.dll",
+      "api-ms-win-crt-heap-l1-1-0.dll",
+      "api-ms-win-crt-locale-l1-1-0.dll",
+      "api-ms-win-crt-private-l1-1-0.dll",
+      "api-ms-win-crt-runtime-l1-1-0.dll",
+      "api-ms-win-crt-stdio-l1-1-0.dll",
+      "api-ms-win-crt-string-l1-1-0.dll",
+      "kernel32.dll"
+    ]
+  },
+  "scope": "Archive integrity, supplied build hashes and reviewed document bytes; no binary execution or native acceptance."
+}
diff --git a/harness/reviews/prerelease37-downloaded-package-20260924.md b/harness/reviews/prerelease37-downloaded-package-20260924.md
index cbbcefde..bd9ef418 100644
--- a/harness/reviews/prerelease37-downloaded-package-20260924.md
+++ b/harness/reviews/prerelease37-downloaded-package-20260924.md
@@ -33,6 +33,9 @@ metadata and its integrity; it did not independently analyze executable imports,
 regenerate dependency notices or run the packaged products. The separate
 downloaded-package QA and native/server evidence remain required.
 
+The [inspector, raw JSON output and document pins](../experiments/prerelease37-package-integrity-20260924/README.md)
+are retained for read-only reproduction against a freshly downloaded ZIP.
+
 The two companion kit ZIPs and their SHA files (assets21–24) were also uploaded
 to this draft and freshly downloaded byte-for-byte. State/Traceability ZIP:
 9,691 bytes, SHA-256