# Recover original evidence across all three Macs

The authorised SCIFD review continues by recovering original requirements and their evidence before final plans. **M16, M6 and Mac Mini remain separate sources**, with copies and generated summaries tracked back to their origin. This is a bounded continuation record, not a final audit, repair programme or requested pause. Full review and current operational acceptance remain incomplete.

## All three Macs retain distinct evidence gaps

The [source map](</Users/diaz_m62/research_notes/Estate forensic review 2/machines/machine_data_source_map.md>) contains **57 rows: 19 data classes for each host**. It records known locations, dated evidence, review depth, original-versus-copy relationships and safe next reads. It is not an exhaustive inventory.

| Mac | Established direction or evidence | Still to establish |
|---|---|---|
| M16 | Adopted Console/event-spine direction; local session and service metadata | Completed M6 bridge, authoritative stores, original media and current delivery |
| M6 | Existing source/service host, historical database imports and inherited M1/M5 archives | Source completeness, current database freshness, importer limits and archive lineage |
| Mac Mini | Distinct capture, communications, hub and backup service metadata | Original recording locations, unnamed communications repository, process ownership and restore evidence |

The map keeps chats/browser exports, Git repositories, firmware/configuration, logs/queues, databases/schemas, documents, recordings/transcripts, downloads/attachments, scans/images/OCR, slides/spreadsheets, mail/calendar/contacts, device exports, cloud mirrors, backups, external media and personal/business communications in scope. Connector availability does not mean content was reviewed. A copy on M16 does not establish completeness on M6 or Mini; narrow inventories establish no class absence. ([Map and lineage](</Users/diaz_m62/research_notes/Estate forensic review 2/machines/machine_data_source_map.json>))

## Indexed coverage advances; acceptance does not

Primary adds **11 full indexed source versions / 177,278 characters**: 56/251 reviewed, with 195 pending rows across 179 exact-hash bodies / 5,264,083 characters. One normalised-equivalent masterclass variant adds no independent corroboration. Secondary adds **4 full indexed bodies / 157,991 characters**: 231/269 current versions reviewed, with 38 pending versions across 32 bodies / 6,005,287 characters. These denominators remain separate. ([Primary receipt](</Users/diaz_m62/research_notes/Estate forensic review 2/primary/merge_receipt.json>); [secondary checkpoint](</Users/diaz_m62/research_notes/Estate forensic review 2/secondary/checkpoint_summary.json>))

Machines adds five receipt-detail reviews, with **zero new full-prose reviews, closures or current acceptances**. The preserved register remains 707 groups, 501 asks, 626 open substantive details and 391 asks marked `UNVERIFIED_CURRENT`. The writer's inline Python check exited 0: 45/45 lane manifest members matched hashes/sizes; counts reconciled. Hash integrity and reading coverage are not tests of underlying claims. ([Machine validation](</Users/diaz_m62/research_notes/Estate forensic review 2/machines/machines_validation.json>); [checkpoint manifest](</Users/diaz_m62/research_notes/Estate forensic review 2/SESSION_CHECKPOINT_MANIFEST-2026-10-13-1939.json>))

## Original requirements and contradictions guide the next reads

Recovered requests include reliable capture, full asks/answers, agent handover and communications beyond WhatsApp. Imported user-labelled relays remain labelled evidence, not independently authenticated direct messages. A copied audit admits only 2/17 Plaud transcripts checked verbatim before a later assistant claims 17 verified packs. A hardware summary says a receiver was tested while its detailed transcript says it was not fitted and is the next test. Both are bounded source contradictions; original media and current acceptance remain **UNVERIFIED**. ([Secondary anchors](</Users/diaz_m62/research_notes/Estate forensic review 2/secondary/cross_lane_anchors.json>); [primary annotations](</Users/diaz_m62/research_notes/Estate forensic review 2/primary/semantic_reviews.json>))

Continue primary from the [remaining exact-hash workload](</Users/diaz_m62/research_notes/Estate forensic review/notebook_primary/resume_batch01/pending_source_workload.json>). Secondary resumes batch 68 at character 0, length 43,919; skip already-reviewed 76. Machines follows [safe next reads](</Users/diaz_m62/research_notes/Estate forensic review 2/machines/machines_next_safe_reads.json>): original recording manifests, Mini service-to-repository lineage and exact historical importer/harvester predicates. Retain incomplete chats, Studio/media, broader data, privacy boundaries and current-runtime gaps. Exact commands and restrictions are in the [handover](</Users/diaz_m62/HANDOVER-2026-10-13-1939.md>).


## Perplexity incident reconciliation on 13 October 2026 at 21:57 AEDT

The [incident findings](</Users/diaz_m62/research_notes/Estate forensic review 2/incident_reconciliation_20261013/findings.md>) distinguish Perplexity’s reported blocked attempt from Claude’s separate safety-hook block and later executed collector. Claude’s original result contains `EXIT=0`; all 91 receipt entries match. **Gate 1 is incomplete:** the narrow collection has scope/capture deviations and does not establish the broader three-Mac acceptance standard. The full saved Perplexity export was reviewed across 2,823 lines; original activity records and 24 citation definitions remain missing.

The [machine-map supplement](</Users/diaz_m62/research_notes/Estate forensic review 2/incident_reconciliation_20261013/machine_map_delta.json>) retains all 57 rows and adds eight bounded M16 evidence updates. M6 and Mac Mini retain their own dated evidence and missing-original scopes; no new remote collection or current acceptance is claimed.

Secondary review resumed through main batch 68: **232/269 current versions reviewed; 37 versions / 31 distinct bodies / 5,961,368 characters pending**. Resume batch 69; skip already-reviewed 76. Primary remains 56/251. `python3 '/Users/diaz_m62/research_notes/Estate forensic review 2/incident_reconciliation_20261013/validate.py'` exited **0** with 199 integrity/consistency assertions before the final checkpoint manifest. These are audit checks, not service or hardware tests. The earlier coverage figures above describe the prior checkpoint.


## Continued original-source review at 2026-10-13T22:26:46.484607+11:00

The full saved Notebook Table Enrichment Status conversation shows a pasted correction followed by a return to the older “parked sandbox / waiting for approval” account. The later request to enrich the notebook with all resources and frustrations receives database-building SQL, including a changed project target. These are historical proposed commands. The [read receipt](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/secondary_batch69_read_receipt.json>) preserves exact anchors.

The cited M6 ruling now has an original: the read-only SSH collector exited 0 and recovered 4,742 bytes with SHA-256 `5e9f96811f90dc7b3a500a146e94c431494e576b9361cb44dbdac4951000107c`, matching the earlier inventory. Its branch counts and ticket/login claims remain historical statements, not fresh database observations. [Original ruling and collection time](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/m6_original_ruling.json>).

Mac Mini metadata collection also exited 0. Seven scripts and seven service plists match their earlier saved hashes. A newly identified repository at `/Users/fabiandiaz/.tas` contains the tracked Plaud daily-brief path; estate-refresh and fleet-health are absent from its index. The refresh-token script has no enclosing Git repository. Three command-hub/Telegram paths are tracked in `code/fdos-command`. This establishes selected file/repository links; it does not identify every communications store or prove current service health. [Machine evidence](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/machine_evidence_delta.json>).

Two complete saved secondary bodies add 88,658 characters: **234/269 current versions reviewed; 35 versions / 29 distinct bodies / 5,872,710 characters pending**. Resume batch 71, skip 76. Primary remains 56/251. The TEKTELIC article is background vendor material, with original videos and PORTABOOM performance unverified. The machine session baseline remains 707 groups / 501 asks / 626 open substantive details / 391 UNVERIFIED_CURRENT asks; one original ruling is a separate document review. [Merge receipt](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/secondary_merge_receipt.json>).

Earlier checkpoint manifests are historical. Copies of the four prior registers are retained in this continuation folder, so the old manifest can be checked against those bytes. Use this folder’s `validate.py` for the new checkpoint. Gate 1 remains incomplete.


The later [M6 bulk-import receipt](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/m6_bulk_receipt.json>) was also recovered with SSH exit 0: all 9,697 bytes match the earlier inventory hash. It records a 21 September 22:25 AEST completion claim—Plaud items 11→31, rollback attempts, a committed retry and a zero-insert rerun. Its unresolved timing-rule and prior-role questions remain open. The review has now read two original M6 documents. Those receipts do not independently establish the SQL results, raw-recording fidelity or current branch health. [Follow-up analysis](</Users/diaz_m62/research_notes/Estate forensic review 2/continuation_20261013_2210/m6_bulk_followup_analysis.json>).