P28-02-EQ: 意味を保つ軽量化：同等性の先行固定（harness）

docs/plans/original-completion-2026-10-02/execution/p28-02/eq/IMPLEMENTATION.md

@@ -707,3 +707,17 @@ limit is kept; the Runner configuration is not changed.
   parsed and memoized by SHA; restore uses the memoized skeleton, so join and comparison do
   not parse again. compare_trees records nodes shared with the immutable trees instead of
   deep copies; keys use inline text.
+
+### Self-contained bundle for the sandboxed native-verify (repair 11)
+
+The formal p28-02-eq-native-verify runs under the Runner seatbelt, which denies reading data
+under the home directory except the validation checkout and the task runtime (the bundle is in
+the runtime's BUILD_OUTPUT_DIR). The first S5 validation failed on the fixture for this reason.
+run_eq now copies the fixture to inputs/fixture/ and the read-only manifest with its nine
+destinations to inputs/readonly/ before any phase, and checks the copies against the admission
+pins (bundle_inputs); the seal covers them. verify_eq passes those copies to actual_pins
+(bundled_inputs applies collector.inputs' rule: each manifest destination lies in the original
+read-only directory and its copy has the recorded bytes and SHA). The engine (/Applications) and
+the machine model stay read live. Everything else verify_eq recomputes from the bundle and the
+checkout as before.
+