T0-E1.2 independent re-audit findings

Finding	Verdict	Independent basis	Residual
T0F-001	PARTIALLY_FIXED	Active-role helper and group short-circuits were removed in many paths, but academic_calendar_scope.py still derives viewer/manage branches from preferred scola_role; runtime conflict evidence is not bound to the current tree.	Complete authority call-site cleanup and rerun live conflict probes.
T0F-003	NOT_FIXED	Running e12_evidence_identity_validator.py returns FAIL: BE tree mismatch, runtime tree mismatch, and non-docs tip path.	Rebuild/re-certify manifest after the 5232370 application change, or certify a reproducible exact ancestor.
T0F-004	PARTIALLY_FIXED	Live entitlement payload is now non-empty and OFF probes exist; no independent positive “one entitlement on, unrelated package denied” proof was accepted.	Complete positive and native-RPC boundary proof on exact runtime.
T0F-005	PARTIALLY_FIXED	Current matrix reports cross-tenant denial, but evidence is frozen against stale BE application identity.	Re-run and bind before/after security state to current runtime.
T0F-006	CLOSED_BY_INDEPENDENT_AUDIT	Provision script now requires explicit password, rejects predictable values, and does not print the secret; direct no-password invocation exits 1 with no-default error.	Keep production-path inventory regression.
T0F-007	PARTIALLY_FIXED	Source gate covers /api, /web/dataset, and product web paths; matrix reports denial, but stale manifest prevents exact-runtime closure.	Re-run direct API/RPC read and mutation after re-certification.
T0F-008	PARTIALLY_FIXED	Native reset/signup block routes exist and invalid token returns 404; a valid-token establishment proof is not independently demonstrated.	Prove valid native token cannot create/set a customer password.
T0F-009	PARTIALLY_FIXED	Advisory locking and fail-closed helpers are present; matrix claims concurrency/failure cases but no fresh exact-runtime independent injection was completed.	Independently exercise issue/consume/revoke/audit failures.
T0F-014	PARTIALLY_FIXED	29-case property set equality is present, but case assertions remain implementation-produced and are not enough to repair stale runtime identity.	Independently reconstruct DEC-014 properties and verify live assertions.
T0F-015	PARTIALLY_FIXED	Sensitive dataset model gate is present and matrix reports partner/user/relation denials; current manifest/runtime mismatch prevents closure.	Re-run all alternate RPC methods against current exact runtime.
T0F-002	CLOSED_BY_INDEPENDENT_AUDIT	Existing dataset mutation regression remains covered.	None observed.
T0F-013	CLOSED_BY_INDEPENDENT_AUDIT	Route checksum/denominator remains covered; no regression observed in current snapshot.	None observed.

T0F-010, T0F-011, and T0F-012 remain outside this audit and open for T0-E2.