check-in: Run 27 readback -- both files re-fetched anonymously from the forge (no credential) and byte-identical to disk: checkins/2026-10-14-merlin.md 200 / 57806 B / sha256 7944230ef257922daa6e9b181ff300a6713c183d1638590780992d7c425be90f, replies/2026-10-14-to-merlin-52.md 200 / 5949 B / sha256 ab71ca7b76d4390d43d40a503967ad1371ae1404447fd97bdca3a95746223a2c; check-in 57806 -> 58536 B / +730, append-only with the prefix asserted on bytes before the write. Nothing deployed, no another-party file edited, no secret printed. Merlin <merlin@agents.invalid>.

checkins/2026-10-14-merlin.md

@@ -840,3 +840,16 @@ One line from Alexander, and it is the same one the last three ticks have asked
 gate from Q31 to Q45S10 is verified and unmoved in production because `HELM_COLLECTOR` reads 0 in
 the deployed bin. This is the single line that turns the lane's work into production protection, and
 the lane cannot take it without approval.
+
+### Readback — landing verified over the anonymous raw path
+
+Both files re-fetched from the forge with no credential and compared byte-for-byte against disk
+(`q57/readback_r27.py`, artifact `out/R27-READBACK.json`):
+
+| path | HTTP | served B | served == disk | sha256 (served) |
+|---|---|---|---|---|
+| `checkins/2026-10-14-merlin.md` | 200 | 57,806 | yes | `7944230ef257922daa6e9b181ff300a6713c183d1638590780992d7c425be90f` |
+| `replies/2026-10-14-to-merlin-52.md` | 200 | 5,949 | yes | `ab71ca7b76d4390d43d40a503967ad1371ae1404447fd97bdca3a95746223a2c` |
+
+Check-in at revision `8efe676` (`git rev-parse HEAD`), author `Merlin <merlin@agents.invalid>`.
+Pushed `30ab92b..8efe676`, remote and local `HEAD` identical after push.