Keep the originals.
Rebuild the index.

The actual Typer CLI ran through a guarded Python launcher. Commands below use its photo-archive entrypoint name. Only the disposable data-root prefix is replaced with $DEMO_ROOT. Refusal messages are labeled excerpts; full private tracebacks are omitted.

1. Exit 01.692 seconds

   $ photo-archive init-volume $DEMO_ROOT/archive
   initialized $DEMO_ROOT/archive

2. Exit 12.273 seconds

   $ photo-archive init-volume $DEMO_ROOT/archive
   [stderr excerpt] FileExistsError: [Errno 17] File exists:

3. Exit 01.943 seconds

   $ photo-archive stage-osxphotos $DEMO_ROOT/archive --source-library-uuid SYNTHETIC-DEMO-LIBRARY --metadata-json $DEMO_ROOT/metadata/DE000001-2026-4000-8000-000000000001.json --resource $DEMO_ROOT/fixtures/DE000001-2026-4000-8000-000000000001.png
   {"archive_id": "PFA1-DE000001-2026-4000-8000-000000000001", "state": "archive_verified", "resources": 2}

4. Exit 01.838 seconds

   $ photo-archive stage-osxphotos $DEMO_ROOT/archive --source-library-uuid SYNTHETIC-DEMO-LIBRARY --metadata-json $DEMO_ROOT/metadata/DE000002-2026-4000-8000-000000000002.json --resource $DEMO_ROOT/fixtures/DE000002-2026-4000-8000-000000000002.png
   {"archive_id": "PFA1-DE000002-2026-4000-8000-000000000002", "state": "archive_verified", "resources": 2}

5. Exit 01.833 seconds

   $ photo-archive stage-osxphotos $DEMO_ROOT/archive --source-library-uuid SYNTHETIC-DEMO-LIBRARY --metadata-json $DEMO_ROOT/metadata/DE000003-2026-4000-8000-000000000003.json --resource $DEMO_ROOT/fixtures/DE000003-2026-4000-8000-000000000003.png
   {"archive_id": "PFA1-DE000003-2026-4000-8000-000000000003", "state": "archive_verified", "resources": 2}

6. Exit 01.888 seconds

   $ photo-archive verify $DEMO_ROOT/archive
   {"assets": 3, "resources": 6, "status": "ok"}

7. Exit 22.362 seconds

   $ photo-archive rebuild-index $DEMO_ROOT/archive $DEMO_ROOT/state/archive.sqlite
   [stderr excerpt] Got unexpected extra argument(s)

8. Exit 01.765 seconds

   $ photo-archive rebuild-index $DEMO_ROOT/archive --destination $DEMO_ROOT/state/archive.sqlite
   {"assets": 3, "path": "$DEMO_ROOT/state/archive.sqlite"}

9. Exit 01.769 seconds

   $ photo-archive rebuild-index $DEMO_ROOT/archive --destination $DEMO_ROOT/state/archive.sqlite
   {"assets": 3, "path": "$DEMO_ROOT/state/archive.sqlite"}

10. Exit 01.896 seconds

    $ photo-archive verify $DEMO_ROOT/archive
    {"assets": 3, "resources": 6, "status": "ok"}

Between the initial and rebuilt index, the guarded driver removed only $DEMO_ROOT/state/archive.sqlite. Its recorded file identity and both database snapshots are in the public receipt.

The four named source files below match the committed revision and retain the same hashes after the run. Six focused, existing source tests passed: staging success and overwrite refusal, sentinel enforcement, resource verification and corruption rejection, and complete index reconstruction.

The 13 canonical files are three PNG originals, three retained metadata JSONs, three manifests, three event ledgers and one volume sentinel. Every file’s size and SHA-256 match before and after. The public receipt includes both complete file-identity snapshots and both index row sets.

The original source checkout remained unchanged. An explicit allowlist of committed code and narrow tests ran in an isolated copy. Three code-generated PNGs and minimal invented metadata replaced all real library inputs. The original home directories and real-volume paths were hidden; the network namespace was isolated. No Photos API, production catalog, archive server, model or enrichment operation ran.

Initializing the existing volume returned exit 1 without changing it. A positional index-destination sample returned exit 2 without creating a database; the successful commands use --destination. Staging retains a metadata JSON as a second resource, so three originals correctly yield six total resource rows. These are observations from the unchanged source.

Two test setup attempts encountered the sandbox’s read-only device restriction; disabling pytest capture and logging resolved them. The same six source tests then passed. Full private setup and failure receipts are retained outside this public exhibit.